Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
NEW ORDER_.exe

Overview

General Information

Sample name:NEW ORDER_.exe
Analysis ID:1560971
MD5:1a8ae43a449f63e9f91d429fe7b21a18
SHA1:abd2a58b8df340f0791eaaf522841e6f5484ce13
SHA256:87e77805c61d64114809ab00f0d224e261109e968300ae193c0a9024caa97807
Tags:exeuser-James_inthe_box
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Query firmware table information (likely to detect VMs)
Queues an APC in another process (thread injection)
Reads the DNS cache
Sample uses process hollowing technique
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Uses ipconfig to lookup or modify the Windows network settings
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
One or more processes crash
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • NEW ORDER_.exe (PID: 7456 cmdline: "C:\Users\user\Desktop\NEW ORDER_.exe" MD5: 1A8AE43A449F63E9F91D429FE7B21A18)
    • svchost.exe (PID: 7532 cmdline: "C:\Users\user\Desktop\NEW ORDER_.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • ipconfig.exe (PID: 7628 cmdline: "C:\Windows\SysWOW64\ipconfig.exe" MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)
          • cmd.exe (PID: 7708 cmdline: /c del "C:\Windows\SysWOW64\svchost.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • explorer.exe (PID: 6692 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
        • WerFault.exe (PID: 6304 cmdline: C:\Windows\system32\WerFault.exe -u -p 4056 -s 3536 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.9net88.net/ge07/"], "decoy": ["amyard.shop", "eloshost.xyz", "g18q11a.top", "orensic-vendor-735524320.click", "ithin-ksvodn.xyz", "xhyx.top", "elonix-traceglow.pro", "cillascrewedsedroth.cfd", "wner-nyquh.xyz", "reyhazeusa.shop", "esmellretaperetotal.cfd", "hqm-during.xyz", "pipagtxcorrelo.xyz", "lray-civil.xyz", "apybarameme.xyz", "rbuds.shop", "hild-fcudh.xyz", "rkgexg.top", "estwestcottwines.shop", "giyztm.xyz", "epehr.pics", "lways-vhyrp.xyz", "acifictechnologycctv.net", "iscinddocenaemlynne.cfd", "ridesmaidgiftsboutiqueki.shop", "ubtleclothingco.fashion", "hemicans.xyz", "ebaoge318.top", "zoc-marriage.xyz", "ngeribe2.homes", "oal-ahzgwo.xyz", "eries-htii.xyz", "ool-covers76.xyz", "ecurityemployment.today", "croom.net", "f7y2i9fgm.xyz", "earch-lawyer-consultation.today", "066iwx2t.shop", "ound-omagf.xyz", "ivglass.xyz", "fdyh-investment.xyz", "yegle.net", "eader-aaexvn.xyz", "dvle-father.xyz", "onsfskfsmpfssfpewqdsawqe.xyz", "ffect-xedzl.xyz", "ood-packaging-jobs-brasil.today", "lasterdeals.shop", "ehkd.top", "pm-22-ns-2.click", "ocockbowerlybrawer.cfd", "ostcanadantpl.top", "vrkof-point.xyz", "lsader.app", "nce-ystyx.xyz", "azl.pro", "ea-yogkkb.xyz", "isit-txax.xyz", "rowadservepros.net", "6282.xyz", "roduct-xgky.xyz", "wner-nyquh.xyz", "sfmoreservicesllc.lat", "rasko.net"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.2404261388.000000000E470000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_772cc62dunknownunknown
  • 0xaf2:$a2: pass
  • 0xaf8:$a3: email
  • 0xaff:$a4: login
  • 0xb06:$a5: signin
  • 0xb17:$a6: persistent
  • 0xcea:$r1: C:\Users\user\AppData\Roaming\K9LQ3T73\K9Llog.ini
00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 34 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          2.2.svchost.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x5451:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          2.2.svchost.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          2.2.svchost.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x17a09:$sqlite3step: 68 34 1C 7B E1
          • 0x17b1c:$sqlite3step: 68 34 1C 7B E1
          • 0x17a38:$sqlite3text: 68 38 2A 90 C5
          • 0x17b5d:$sqlite3text: 68 38 2A 90 C5
          • 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 15 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Uncommon Svchost Parent Process
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\NEW ORDER_.exe", CommandLine: "C:\Users\user\Desktop\NEW ORDER_.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\NEW ORDER_.exe", ParentImage: C:\Users\user\Desktop\NEW ORDER_.exe, ParentProcessId: 7456, ParentProcessName: NEW ORDER_.exe, ProcessCommandLine: "C:\Users\user\Desktop\NEW ORDER_.exe", ProcessId: 7532, ProcessName: svchost.exe
          Sigma detected: Windows Processes Suspicious Parent Directory
          Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\NEW ORDER_.exe", CommandLine: "C:\Users\user\Desktop\NEW ORDER_.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\NEW ORDER_.exe", ParentImage: C:\Users\user\Desktop\NEW ORDER_.exe, ParentProcessId: 7456, ParentProcessName: NEW ORDER_.exe, ProcessCommandLine: "C:\Users\user\Desktop\NEW ORDER_.exe", ProcessId: 7532, ProcessName: svchost.exe

          Suricata Signatures

          ⊘No Suricata rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Found malware configuration
          Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.9net88.net/ge07/"], "decoy": ["amyard.shop", "eloshost.xyz", "g18q11a.top", "orensic-vendor-735524320.click", "ithin-ksvodn.xyz", "xhyx.top", "elonix-traceglow.pro", "cillascrewedsedroth.cfd", "wner-nyquh.xyz", "reyhazeusa.shop", "esmellretaperetotal.cfd", "hqm-during.xyz", "pipagtxcorrelo.xyz", "lray-civil.xyz", "apybarameme.xyz", "rbuds.shop", "hild-fcudh.xyz", "rkgexg.top", "estwestcottwines.shop", "giyztm.xyz", "epehr.pics", "lways-vhyrp.xyz", "acifictechnologycctv.net", "iscinddocenaemlynne.cfd", "ridesmaidgiftsboutiqueki.shop", "ubtleclothingco.fashion", "hemicans.xyz", "ebaoge318.top", "zoc-marriage.xyz", "ngeribe2.homes", "oal-ahzgwo.xyz", "eries-htii.xyz", "ool-covers76.xyz", "ecurityemployment.today", "croom.net", "f7y2i9fgm.xyz", "earch-lawyer-consultation.today", "066iwx2t.shop", "ound-omagf.xyz", "ivglass.xyz", "fdyh-investment.xyz", "yegle.net", "eader-aaexvn.xyz", "dvle-father.xyz", "onsfskfsmpfssfpewqdsawqe.xyz", "ffect-xedzl.xyz", "ood-packaging-jobs-brasil.today", "lasterdeals.shop", "ehkd.top", "pm-22-ns-2.click", "ocockbowerlybrawer.cfd", "ostcanadantpl.top", "vrkof-point.xyz", "lsader.app", "nce-ystyx.xyz", "azl.pro", "ea-yogkkb.xyz", "isit-txax.xyz", "rowadservepros.net", "6282.xyz", "roduct-xgky.xyz", "wner-nyquh.xyz", "sfmoreservicesllc.lat", "rasko.net"]}
          Multi AV Scanner detection for submitted file
          Source: NEW ORDER_.exeReversingLabs: Detection: 65%
          Yara detected FormBook
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.NEW ORDER_.exe.3ab0000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.NEW ORDER_.exe.3ab0000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.7% probability
          Machine Learning detection for sample
          Source: NEW ORDER_.exeJoe Sandbox ML: detected
          Source: NEW ORDER_.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: Binary string: ipconfig.pdb source: svchost.exe, 00000002.00000002.1374088105.0000000002C12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1373711081.0000000002C2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374368775.00000000031D0000.00000040.10000000.00040000.00000000.sdmp, ipconfig.exe, ipconfig.exe, 00000005.00000002.3748987818.0000000000ED0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: ipconfig.pdbGCTL source: svchost.exe, 00000002.00000002.1374088105.0000000002C12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1373711081.0000000002C2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374368775.00000000031D0000.00000040.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3748987818.0000000000ED0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: NEW ORDER_.exe, 00000000.00000003.1310978306.0000000003E30000.00000004.00001000.00020000.00000000.sdmp, NEW ORDER_.exe, 00000000.00000003.1311575770.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1318911457.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1320775755.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374502488.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374502488.0000000003300000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3750816101.00000000034B0000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3750816101.000000000364E000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000003.1376396175.000000000330A000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000003.1374209665.0000000003148000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: NEW ORDER_.exe, 00000000.00000003.1310978306.0000000003E30000.00000004.00001000.00020000.00000000.sdmp, NEW ORDER_.exe, 00000000.00000003.1311575770.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1318911457.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1320775755.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374502488.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374502488.0000000003300000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, ipconfig.exe, 00000005.00000002.3750816101.00000000034B0000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3750816101.000000000364E000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000003.1376396175.000000000330A000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000003.1374209665.0000000003148000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: svchost.pdb source: explorer.exe, 00000004.00000002.2404877912.0000000010B1F000.00000004.80000000.00040000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3752195836.00000000039FF000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3749463893.0000000003052000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3766323699.000000000A37F000.00000004.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdbUGP source: explorer.exe, 00000004.00000002.2404877912.0000000010B1F000.00000004.80000000.00040000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3752195836.00000000039FF000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3749463893.0000000003052000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3766323699.000000000A37F000.00000004.80000000.00040000.00000000.sdmp
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00736CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00736CA9
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007360DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_007360DD
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007363F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_007363F9
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0073EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0073EB60
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0073F56F FindFirstFileW,FindClose,0_2_0073F56F
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0073F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_0073F5FA
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00741B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00741B2F
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00741C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00741C8A
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00741F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00741F94

          Networking

          barindex
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.9net88.net/ge07/
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00744EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_00744EB5
          Source: global trafficDNS traffic detected: DNS query: www.ood-packaging-jobs-brasil.today
          Source: global trafficDNS traffic detected: DNS query: www.acifictechnologycctv.net
          Source: global trafficDNS traffic detected: DNS query: www.reyhazeusa.shop
          Source: global trafficDNS traffic detected: DNS query: www.ostcanadantpl.top
          Source: global trafficDNS traffic detected: DNS query: api.msn.com
          Source: explorer.exe, 00000004.00000002.2384272099.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1327589479.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2387608443.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274116897.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3701991146.00000000098D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3763795534.00000000098D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: explorer.exe, 00000004.00000002.2384272099.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1327589479.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2387608443.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274116897.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3701991146.00000000098D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3763795534.00000000098D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: explorer.exe, 00000004.00000002.2384272099.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1327589479.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2387608443.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274116897.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3701991146.00000000098D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3763795534.00000000098D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: explorer.exe, 00000004.00000002.2384272099.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1327589479.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2387608443.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274116897.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3701991146.00000000098D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3763795534.00000000098D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
          Source: explorer.exe, 00000004.00000000.1327078946.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.2385993948.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.2385254686.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.3769483542.000000000C745000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: explorer.exe, 0000000E.00000002.3769483542.000000000C745000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.microsoft.
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.066iwx2t.shop
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.066iwx2t.shop/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.066iwx2t.shop/ge07/www.g18q11a.top
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.066iwx2t.shopReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.9net88.net
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.9net88.net/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.9net88.net/ge07/www.dvle-father.xyz
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.9net88.netReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acifictechnologycctv.net
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acifictechnologycctv.net/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acifictechnologycctv.net/ge07/www.reyhazeusa.shop
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.acifictechnologycctv.netReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.dvle-father.xyz
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.dvle-father.xyz/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.dvle-father.xyz/ge07/www.yegle.net
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.dvle-father.xyzReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ehkd.top
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ehkd.top/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ehkd.top/ge07/www.ivglass.xyz
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ehkd.topReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.epehr.pics
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.epehr.pics/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.epehr.pics/ge07/www.ngeribe2.homes
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.epehr.picsReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.f7y2i9fgm.xyz
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.f7y2i9fgm.xyz/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.f7y2i9fgm.xyz/ge07/www.giyztm.xyz
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.f7y2i9fgm.xyzReferer:
          Source: explorer.exe, 00000004.00000000.1325301295.00000000071B2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.foreca.com
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.g18q11a.top
          Source: explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.g18q11a.top/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.g18q11a.topReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.giyztm.xyz
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.giyztm.xyz/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.giyztm.xyz/ge07/www.epehr.pics
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.giyztm.xyzReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ivglass.xyz
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ivglass.xyz/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ivglass.xyz/ge07/www.nce-ystyx.xyz
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ivglass.xyzReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nce-ystyx.xyz
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nce-ystyx.xyz/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nce-ystyx.xyz/ge07/www.9net88.net
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.nce-ystyx.xyzReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ngeribe2.homes
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ngeribe2.homes/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ngeribe2.homes/ge07/www.ehkd.top
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ngeribe2.homesReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ood-packaging-jobs-brasil.today
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ood-packaging-jobs-brasil.today/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ood-packaging-jobs-brasil.today/ge07/www.acifictechnologycctv.net
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ood-packaging-jobs-brasil.todayReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ostcanadantpl.top
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ostcanadantpl.top/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ostcanadantpl.top/ge07/www.f7y2i9fgm.xyz
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ostcanadantpl.topReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.reyhazeusa.shop
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.reyhazeusa.shop/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.reyhazeusa.shop/ge07/www.ostcanadantpl.top
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.reyhazeusa.shopReferer:
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yegle.net
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yegle.net/ge07/
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yegle.net/ge07/www.066iwx2t.shop
          Source: explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.yegle.netReferer:
          Source: explorer.exe, 00000004.00000000.1327589479.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
          Source: explorer.exe, 00000004.00000000.1327589479.000000000913F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 00000004.00000002.2387608443.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3698685262.0000000009AD1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3764000347.0000000009AD1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2452509158.0000000009AD1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2440790966.0000000009AD1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2466769749.0000000009AD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 0000000E.00000002.3764000347.0000000009916000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 00000004.00000000.1327589479.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2387608443.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
          Source: explorer.exe, 0000000E.00000003.2466769749.00000000099D2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3764000347.00000000099B4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3698685262.00000000099B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows??K
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
          Source: explorer.exe, 0000000E.00000003.2452509158.0000000009A61000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2440790966.0000000009A71000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2466769749.00000000099D2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3764000347.00000000099B4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3698685262.00000000099B4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2450949413.0000000009A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?=
          Source: explorer.exe, 00000004.00000000.1325301295.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2382491394.0000000007276000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?t
          Source: explorer.exe, 00000004.00000000.1327589479.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2387608443.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2466769749.00000000099D2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3764000347.00000000099B4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3698685262.00000000099B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
          Source: explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
          Source: explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm-dark
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAHG-dark
          Source: explorer.exe, 00000004.00000002.2395472104.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1330403346.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2467440128.0000000009B49000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2468224390.0000000009B48000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2471104315.0000000009B42000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2472316992.0000000009B42000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
          Source: explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA12lNhl.img
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
          Source: explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXV829.img
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBUvpML.img
          Source: explorer.exe, 00000004.00000002.2395472104.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1330403346.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
          Source: explorer.exe, 0000000E.00000003.2467440128.0000000009B49000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2468224390.0000000009B48000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2471104315.0000000009B42000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2472316992.0000000009B42000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://outlook.comOB
          Source: explorer.exe, 00000004.00000002.2395472104.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1330403346.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2466769749.0000000009B26000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2467538759.0000000009B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.com
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000004.00000003.2274146619.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2389749148.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1327589479.00000000090F2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/
          Source: explorer.exe, 00000004.00000002.2395472104.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1330403346.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
          Source: explorer.exe, 0000000E.00000003.2467440128.0000000009B49000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2468224390.0000000009B48000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2471104315.0000000009B42000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2472316992.0000000009B42000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://word.office.com%I
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-u
          Source: explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/foodanddrink/recipes/the-syrupy-ingredient-that-totally-enhances-oatmeal-r
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/senator-questions-w
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/play/g
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/play/games/bubbly
          Source: explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/paul-finebaum-ranks-his-top-four-college-football-teams-this-
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
          Source: explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
          Source: explorer.exe, 00000004.00000000.1325301295.00000000071B2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.pollensense.com/
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00746B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00746B0C
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00746D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00746D07
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00746B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00746B0C
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00732B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_00732B37

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.NEW ORDER_.exe.3ab0000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.NEW ORDER_.exe.3ab0000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.2404261388.000000000E470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
          Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: NEW ORDER_.exe PID: 7456, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: svchost.exe PID: 7532, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: ipconfig.exe PID: 7628, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Binary is likely a compiled AutoIt script file
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: This is a third-party compiled AutoIt script.0_2_006F3D19
          Source: NEW ORDER_.exeString found in binary or memory: This is a third-party compiled AutoIt script.
          Source: NEW ORDER_.exe, 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_b6b21f48-8
          Source: NEW ORDER_.exe, 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: rSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_c4ac1118-6
          Source: NEW ORDER_.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_bc211644-7
          Source: NEW ORDER_.exeString found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_04ae84c3-9
          Initial sample is a PE file and has a suspicious name
          Source: initial sampleStatic PE information: Filename: NEW ORDER_.exe
          Source: C:\Windows\SysWOW64\ipconfig.exeProcess Stats: CPU usage > 49%
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A320 NtCreateFile,2_2_0041A320
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A3D0 NtReadFile,2_2_0041A3D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A450 NtClose,2_2_0041A450
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A500 NtAllocateVirtualMemory,2_2_0041A500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A31D NtCreateFile,2_2_0041A31D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A44A NtClose,2_2_0041A44A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372B60 NtClose,LdrInitializeThunk,2_2_03372B60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372BF0 NtAllocateVirtualMemory,LdrInitializeThunk,2_2_03372BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372AD0 NtReadFile,LdrInitializeThunk,2_2_03372AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372F30 NtCreateSection,LdrInitializeThunk,2_2_03372F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372FB0 NtResumeThread,LdrInitializeThunk,2_2_03372FB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372F90 NtProtectVirtualMemory,LdrInitializeThunk,2_2_03372F90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372FE0 NtCreateFile,LdrInitializeThunk,2_2_03372FE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,2_2_03372EA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372E80 NtReadVirtualMemory,LdrInitializeThunk,2_2_03372E80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372D30 NtUnmapViewOfSection,LdrInitializeThunk,2_2_03372D30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372D10 NtMapViewOfSection,LdrInitializeThunk,2_2_03372D10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03372DF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372DD0 NtDelayExecution,LdrInitializeThunk,2_2_03372DD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372C70 NtFreeVirtualMemory,LdrInitializeThunk,2_2_03372C70
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372CA0 NtQueryInformationToken,LdrInitializeThunk,2_2_03372CA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03374340 NtSetContextThread,2_2_03374340
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03374650 NtSuspendThread,2_2_03374650
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372BA0 NtEnumerateValueKey,2_2_03372BA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372B80 NtQueryInformationFile,2_2_03372B80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372BE0 NtQueryValueKey,2_2_03372BE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372AB0 NtWaitForSingleObject,2_2_03372AB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372AF0 NtWriteFile,2_2_03372AF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372F60 NtCreateProcessEx,2_2_03372F60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372FA0 NtQuerySection,2_2_03372FA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372E30 NtWriteVirtualMemory,2_2_03372E30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372EE0 NtQueueApcThread,2_2_03372EE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372D00 NtSetInformationFile,2_2_03372D00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372DB0 NtEnumerateKey,2_2_03372DB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372C00 NtQueryInformationProcess,2_2_03372C00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372C60 NtCreateKey,2_2_03372C60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372CF0 NtOpenProcess,2_2_03372CF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372CC0 NtQueryVirtualMemory,2_2_03372CC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03373010 NtOpenDirectoryObject,2_2_03373010
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03373090 NtSetValueKey,2_2_03373090
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033735C0 NtCreateMutant,2_2_033735C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033739B0 NtGetContextThread,2_2_033739B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03373D10 NtOpenProcessToken,2_2_03373D10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03373D70 NtOpenThread,2_2_03373D70
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0321A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,NtClose,2_2_0321A036
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0321A042 NtQueryInformationProcess,2_2_0321A042
          Source: C:\Windows\explorer.exeCode function: 4_2_0E459E12 NtProtectVirtualMemory,4_2_0E459E12
          Source: C:\Windows\explorer.exeCode function: 4_2_0E458232 NtCreateFile,4_2_0E458232
          Source: C:\Windows\explorer.exeCode function: 4_2_0E459E0A NtProtectVirtualMemory,4_2_0E459E0A
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522B60 NtClose,LdrInitializeThunk,5_2_03522B60
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522AD0 NtReadFile,LdrInitializeThunk,5_2_03522AD0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522F30 NtCreateSection,LdrInitializeThunk,5_2_03522F30
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522FE0 NtCreateFile,LdrInitializeThunk,5_2_03522FE0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,5_2_03522EA0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522D10 NtMapViewOfSection,LdrInitializeThunk,5_2_03522D10
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522DD0 NtDelayExecution,LdrInitializeThunk,5_2_03522DD0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522DF0 NtQuerySystemInformation,LdrInitializeThunk,5_2_03522DF0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522C70 NtFreeVirtualMemory,LdrInitializeThunk,5_2_03522C70
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522C60 NtCreateKey,LdrInitializeThunk,5_2_03522C60
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522CA0 NtQueryInformationToken,LdrInitializeThunk,5_2_03522CA0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035235C0 NtCreateMutant,LdrInitializeThunk,5_2_035235C0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03524340 NtSetContextThread,5_2_03524340
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03524650 NtSuspendThread,5_2_03524650
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522BF0 NtAllocateVirtualMemory,5_2_03522BF0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522BE0 NtQueryValueKey,5_2_03522BE0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522B80 NtQueryInformationFile,5_2_03522B80
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522BA0 NtEnumerateValueKey,5_2_03522BA0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522AF0 NtWriteFile,5_2_03522AF0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522AB0 NtWaitForSingleObject,5_2_03522AB0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522F60 NtCreateProcessEx,5_2_03522F60
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522F90 NtProtectVirtualMemory,5_2_03522F90
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522FB0 NtResumeThread,5_2_03522FB0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522FA0 NtQuerySection,5_2_03522FA0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522E30 NtWriteVirtualMemory,5_2_03522E30
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522EE0 NtQueueApcThread,5_2_03522EE0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522E80 NtReadVirtualMemory,5_2_03522E80
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522D00 NtSetInformationFile,5_2_03522D00
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522D30 NtUnmapViewOfSection,5_2_03522D30
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522DB0 NtEnumerateKey,5_2_03522DB0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522C00 NtQueryInformationProcess,5_2_03522C00
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522CC0 NtQueryVirtualMemory,5_2_03522CC0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03522CF0 NtOpenProcess,5_2_03522CF0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03523010 NtOpenDirectoryObject,5_2_03523010
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03523090 NtSetValueKey,5_2_03523090
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035239B0 NtGetContextThread,5_2_035239B0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03523D70 NtOpenThread,5_2_03523D70
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03523D10 NtOpenProcessToken,5_2_03523D10
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00CAA3D0 NtReadFile,5_2_00CAA3D0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00CAA320 NtCreateFile,5_2_00CAA320
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00CAA450 NtClose,5_2_00CAA450
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00CAA31D NtCreateFile,5_2_00CAA31D
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00CAA44A NtClose,5_2_00CAA44A
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03249BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,5_2_03249BAF
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0324A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,5_2_0324A036
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03249BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,5_2_03249BB2
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0324A042 NtQueryInformationProcess,5_2_0324A042
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00736606: CreateFileW,DeviceIoControl,CloseHandle,0_2_00736606
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0072ACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_0072ACC5
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007379D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_007379D3
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0071B0430_2_0071B043
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007032000_2_00703200
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00703B700_2_00703B70
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0072410F0_2_0072410F
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007102A40_2_007102A4
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006FE3E30_2_006FE3E3
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0072038E0_2_0072038E
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0072467F0_2_0072467F
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007106D90_2_007106D9
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0075AACE0_2_0075AACE
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00724BEF0_2_00724BEF
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0071CCC10_2_0071CCC1
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006FAF500_2_006FAF50
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006F6F070_2_006F6F07
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0070B11F0_2_0070B11F
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0071D1B90_2_0071D1B9
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007531BC0_2_007531BC
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0072724D0_2_0072724D
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0071123A0_2_0071123A
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006F93F00_2_006F93F0
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007313CA0_2_007313CA
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0070F5630_2_0070F563
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006F96C00_2_006F96C0
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0073B6CC0_2_0073B6CC
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006F77B00_2_006F77B0
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007279C90_2_007279C9
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0070FA570_2_0070FA57
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006F9B600_2_006F9B60
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006F7D190_2_006F7D19
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0070FE6F0_2_0070FE6F
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00719ED00_2_00719ED0
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006F7FA30_2_006F7FA3
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_015B48780_2_015B4878
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004010302_2_00401030
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D89D2_2_0041D89D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041C3F22_2_0041C3F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402D902_2_00402D90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409E4C2_2_00409E4C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409E502_2_00409E50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E79D2_2_0041E79D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402FB02_2_00402FB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FA3522_2_033FA352
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034003E62_2_034003E6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E3F02_2_0334E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E02742_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C02C02_2_033C02C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DA1182_2_033DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033301002_2_03330100
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C81582_2_033C8158
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F41A22_2_033F41A2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034001AA2_2_034001AA
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F81CC2_2_033F81CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D20002_2_033D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033407702_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033647502_2_03364750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333C7C02_2_0333C7C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335C6E02_2_0335C6E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033405352_2_03340535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034005912_2_03400591
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E44202_2_033E4420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F24462_2_033F2446
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EE4F62_2_033EE4F6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FAB402_2_033FAB40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F6BD72_2_033F6BD7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA802_2_0333EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033569622_2_03356962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A02_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0340A9A62_2_0340A9A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334A8402_2_0334A840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033428402_2_03342840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033268B82_2_033268B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E8F02_2_0336E8F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03360F302_2_03360F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E2F302_2_033E2F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03382F282_2_03382F28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B4F402_2_033B4F40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BEFA02_2_033BEFA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334CFE02_2_0334CFE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03332FC82_2_03332FC8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FEE262_2_033FEE26
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340E592_2_03340E59
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352E902_2_03352E90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FCE932_2_033FCE93
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FEEDB2_2_033FEEDB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DCD1F2_2_033DCD1F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334AD002_2_0334AD00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03358DBF2_2_03358DBF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333ADE02_2_0333ADE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340C002_2_03340C00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0CB52_2_033E0CB5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330CF22_2_03330CF2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F132D2_2_033F132D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332D34C2_2_0332D34C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0338739A2_2_0338739A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033452A02_2_033452A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E12ED2_2_033E12ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335B2C02_2_0335B2C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0340B16B2_2_0340B16B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332F1722_2_0332F172
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0337516C2_2_0337516C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334B1B02_2_0334B1B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F70E92_2_033F70E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FF0E02_2_033FF0E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EF0CC2_2_033EF0CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033470C02_2_033470C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FF7B02_2_033FF7B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033856302_2_03385630
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F16CC2_2_033F16CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F75712_2_033F7571
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034095C32_2_034095C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DD5B02_2_033DD5B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FF43F2_2_033FF43F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033314602_2_03331460
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FFB762_2_033FFB76
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335FB802_2_0335FB80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B5BF02_2_033B5BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0337DBF92_2_0337DBF9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B3A6C2_2_033B3A6C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FFA492_2_033FFA49
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F7A462_2_033F7A46
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DDAAC2_2_033DDAAC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03385AA02_2_03385AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E1AA32_2_033E1AA3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EDAC62_2_033EDAC6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D59102_2_033D5910
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033499502_2_03349950
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335B9502_2_0335B950
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AD8002_2_033AD800
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033438E02_2_033438E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FFF092_2_033FFF09
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FFFB12_2_033FFFB1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03341F922_2_03341F92
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03303FD22_2_03303FD2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03303FD52_2_03303FD5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03349EB02_2_03349EB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F7D732_2_033F7D73
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F1D5A2_2_033F1D5A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03343D402_2_03343D40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335FDC02_2_0335FDC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B9C322_2_033B9C32
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FFCF22_2_033FFCF2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0321A0362_2_0321A036
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0321B2322_2_0321B232
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032110822_2_03211082
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0321E5CD2_2_0321E5CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03215B302_2_03215B30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03215B322_2_03215B32
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032189122_2_03218912
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03212D022_2_03212D02
          Source: C:\Windows\explorer.exeCode function: 4_2_0E4582324_2_0E458232
          Source: C:\Windows\explorer.exeCode function: 4_2_0E4570364_2_0E457036
          Source: C:\Windows\explorer.exeCode function: 4_2_0E44E0824_2_0E44E082
          Source: C:\Windows\explorer.exeCode function: 4_2_0E44FD024_2_0E44FD02
          Source: C:\Windows\explorer.exeCode function: 4_2_0E4559124_2_0E455912
          Source: C:\Windows\explorer.exeCode function: 4_2_0E452B304_2_0E452B30
          Source: C:\Windows\explorer.exeCode function: 4_2_0E452B324_2_0E452B32
          Source: C:\Windows\explorer.exeCode function: 4_2_0E45B5CD4_2_0E45B5CD
          Source: C:\Windows\explorer.exeCode function: 4_2_108650824_2_10865082
          Source: C:\Windows\explorer.exeCode function: 4_2_1086E0364_2_1086E036
          Source: C:\Windows\explorer.exeCode function: 4_2_108725CD4_2_108725CD
          Source: C:\Windows\explorer.exeCode function: 4_2_10866D024_2_10866D02
          Source: C:\Windows\explorer.exeCode function: 4_2_1086C9124_2_1086C912
          Source: C:\Windows\explorer.exeCode function: 4_2_1086F2324_2_1086F232
          Source: C:\Windows\explorer.exeCode function: 4_2_10869B324_2_10869B32
          Source: C:\Windows\explorer.exeCode function: 4_2_10869B304_2_10869B30
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00ED39FE5_2_00ED39FE
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AA3525_2_035AA352
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035B03E65_2_035B03E6
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034FE3F05_2_034FE3F0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035902745_2_03590274
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035702C05_2_035702C0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035781585_2_03578158
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0358A1185_2_0358A118
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034E01005_2_034E0100
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035A81CC5_2_035A81CC
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035B01AA5_2_035B01AA
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035A41A25_2_035A41A2
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035820005_2_03582000
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035147505_2_03514750
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F07705_2_034F0770
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034EC7C05_2_034EC7C0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0350C6E05_2_0350C6E0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F05355_2_034F0535
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035B05915_2_035B0591
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035A24465_2_035A2446
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035944205_2_03594420
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0359E4F65_2_0359E4F6
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AAB405_2_035AAB40
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035A6BD75_2_035A6BD7
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034EEA805_2_034EEA80
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035069625_2_03506962
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F29A05_2_034F29A0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035BA9A65_2_035BA9A6
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F28405_2_034F2840
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034FA8405_2_034FA840
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0351E8F05_2_0351E8F0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034D68B85_2_034D68B8
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03564F405_2_03564F40
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03510F305_2_03510F30
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03592F305_2_03592F30
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03532F285_2_03532F28
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034E2FC85_2_034E2FC8
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034FCFE05_2_034FCFE0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0356EFA05_2_0356EFA0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F0E595_2_034F0E59
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AEE265_2_035AEE26
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AEEDB5_2_035AEEDB
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03502E905_2_03502E90
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035ACE935_2_035ACE93
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0358CD1F5_2_0358CD1F
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034FAD005_2_034FAD00
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034EADE05_2_034EADE0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03508DBF5_2_03508DBF
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F0C005_2_034F0C00
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034E0CF25_2_034E0CF2
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03590CB55_2_03590CB5
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034DD34C5_2_034DD34C
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035A132D5_2_035A132D
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0353739A5_2_0353739A
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0350B2C05_2_0350B2C0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035912ED5_2_035912ED
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F52A05_2_034F52A0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035BB16B5_2_035BB16B
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0352516C5_2_0352516C
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034DF1725_2_034DF172
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034FB1B05_2_034FB1B0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F70C05_2_034F70C0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0359F0CC5_2_0359F0CC
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035A70E95_2_035A70E9
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AF0E05_2_035AF0E0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AF7B05_2_035AF7B0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035356305_2_03535630
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035A16CC5_2_035A16CC
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035A75715_2_035A7571
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035B95C35_2_035B95C3
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0358D5B05_2_0358D5B0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034E14605_2_034E1460
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AF43F5_2_035AF43F
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AFB765_2_035AFB76
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03565BF05_2_03565BF0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0352DBF95_2_0352DBF9
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0350FB805_2_0350FB80
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AFA495_2_035AFA49
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035A7A465_2_035A7A46
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03563A6C5_2_03563A6C
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0359DAC65_2_0359DAC6
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03535AA05_2_03535AA0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0358DAAC5_2_0358DAAC
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03591AA35_2_03591AA3
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0350B9505_2_0350B950
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F99505_2_034F9950
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035859105_2_03585910
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0355D8005_2_0355D800
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F38E05_2_034F38E0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AFF095_2_035AFF09
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034B3FD25_2_034B3FD2
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034B3FD55_2_034B3FD5
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F1F925_2_034F1F92
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AFFB15_2_035AFFB1
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F9EB05_2_034F9EB0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035A1D5A5_2_035A1D5A
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_034F3D405_2_034F3D40
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035A7D735_2_035A7D73
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0350FDC05_2_0350FDC0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03569C325_2_03569C32
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_035AFCF25_2_035AFCF2
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00CAC3F25_2_00CAC3F2
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00CAE79D5_2_00CAE79D
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00C92D905_2_00C92D90
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00C99E4C5_2_00C99E4C
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00C99E505_2_00C99E50
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00C92FB05_2_00C92FB0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0324A0365_2_0324A036
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03245B305_2_03245B30
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03245B325_2_03245B32
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0324B2325_2_0324B232
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_032489125_2_03248912
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_032410825_2_03241082
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_03242D025_2_03242D02
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_0324E5CD5_2_0324E5CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0332B970 appears 277 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03375130 appears 58 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 033AEA12 appears 86 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 033BF290 appears 105 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03387E54 appears 111 times
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: String function: 03537E54 appears 111 times
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: String function: 0356F290 appears 105 times
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: String function: 034DB970 appears 277 times
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: String function: 0355EA12 appears 86 times
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: String function: 03525130 appears 58 times
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: String function: 0071F8A0 appears 35 times
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: String function: 00716AC0 appears 42 times
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: String function: 0070EC2F appears 68 times
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4056 -s 3536
          Source: NEW ORDER_.exe, 00000000.00000003.1311575770.00000000040FD000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs NEW ORDER_.exe
          Source: NEW ORDER_.exe, 00000000.00000003.1317167645.0000000003F53000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs NEW ORDER_.exe
          Source: NEW ORDER_.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.NEW ORDER_.exe.3ab0000.1.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.2404261388.000000000E470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
          Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: NEW ORDER_.exe PID: 7456, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: svchost.exe PID: 7532, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: ipconfig.exe PID: 7628, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: classification engineClassification label: mal100.troj.evad.winEXE@301/8@6/0
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0073CE7A GetLastError,FormatMessageW,0_2_0073CE7A
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0072AB84 AdjustTokenPrivileges,CloseHandle,0_2_0072AB84
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0072B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_0072B134
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0073E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_0073E1FD
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00736532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,0_2_00736532
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0074C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,0_2_0074C18C
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006F406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_006F406B
          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001b.dbJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_03
          Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4056
          Source: C:\Users\user\Desktop\NEW ORDER_.exeFile created: C:\Users\user~1\AppData\Local\Temp\aut7281.tmpJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeProcess created: C:\Windows\explorer.exe
          Source: NEW ORDER_.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Windows\explorer.exeFile read: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: NEW ORDER_.exeReversingLabs: Detection: 65%
          Source: unknownProcess created: C:\Users\user\Desktop\NEW ORDER_.exe "C:\Users\user\Desktop\NEW ORDER_.exe"
          Source: C:\Users\user\Desktop\NEW ORDER_.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\NEW ORDER_.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\SysWOW64\ipconfig.exe"
          Source: C:\Windows\SysWOW64\ipconfig.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4056 -s 3536
          Source: C:\Windows\SysWOW64\ipconfig.exeProcess created: C:\Windows\explorer.exe explorer.exe
          Source: C:\Users\user\Desktop\NEW ORDER_.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\NEW ORDER_.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\SysWOW64\ipconfig.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"Jump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: wsock32.dllJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: winmm.dllJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.internal.shell.broker.dllJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: aepic.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: twinapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dxgi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wtsapi32.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dwmapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: twinapi.appcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ninput.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: slc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: starttiledata.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: idstore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: usermgrcli.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wlidprov.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: samcli.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.applicationmodel.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: appxdeploymentclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: policymanager.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: msvcp110_win.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: usermgrproxy.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: winsta.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: sndvolsso.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mmdevapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: devobj.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.staterepositoryclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: oleacc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: appextension.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: textshaping.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.ui.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windowmanagementapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: textinputframework.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: inputhost.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: coreuicomponents.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: coreuicomponents.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windowscodecs.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dcomp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: d3d11.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: resourcepolicyclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: d3d10warp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dxcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: d2d1.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: xmllite.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cldapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: fltlib.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dataexchange.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: tiledatarepository.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: staterepository.core.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.staterepository.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: explorerframe.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.staterepositorycore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mrmcorer.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: languageoverlayutil.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: bcp47mrm.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: twinui.pcshell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wkscli.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wincorlib.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cdp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dsreg.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: thumbcache.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.immersiveshell.serviceprovider.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: photometadatahandler.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ntshrui.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cscapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: linkinfo.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ehstorshell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cscui.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: provsvc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: msvcp140.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: stobject.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wmiclnt.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: twinui.appcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: workfoldersshell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: twinui.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: pdh.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: applicationframe.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: rmclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: holographicextensions.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: virtualmonitormanager.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: resourcepolicyclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.ui.immersive.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: abovelockapphost.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: npsm.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.shell.bluelightreduction.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.web.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mscms.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: coloradapterclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.internal.signals.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: tdh.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.staterepositorybroker.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mfplat.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: rtworkq.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: taskflowdataengine.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: structuredquery.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: actxprxy.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.system.launcher.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.security.authentication.web.core.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.data.activities.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.internal.ui.shell.windowtabmanager.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: notificationcontrollerps.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.devices.enumeration.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.globalization.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: icu.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mswb7.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: devdispitemprovider.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.networking.connectivity.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.ui.core.textinput.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: uianimation.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windowsudk.shellcommon.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dictationmanager.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: npmproxy.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: schannel.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: taskschd.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mskeyprotect.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ntasn1.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ncrypt.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ncryptsslp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: pcshellcommonproxystub.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cryptngc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cflapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: shellcommoncommonproxystub.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: execmodelproxy.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: daxexec.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: container.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: uiautomationcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: samlib.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: batmeter.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: inputswitch.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: prnfldr.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: es.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.ui.shell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: capabilityaccessmanagerclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wpnclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dxp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: shdocvw.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: syncreg.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: atlthunk.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: actioncenter.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wevtapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: audioses.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: pnidui.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mobilenetworking.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: netprofm.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wscinterop.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wscapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: networkuxbroker.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ethernetmediamanager.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wlanapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ncsi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dusmapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: werconcpl.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: framedynos.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wer.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: hcproviders.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wpdshserviceobj.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: portabledevicetypes.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: portabledeviceapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cscobj.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: srchadmin.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.storage.search.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: synccenter.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: imapi2.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ieproxy.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: bluetoothapis.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: bluetoothapis.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.ui.xaml.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windowsinternal.composableshell.desktophosting.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: uiamanager.dllJump to behavior
          Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: NEW ORDER_.exeStatic file information: File size 1105408 > 1048576
          Source: NEW ORDER_.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
          Source: NEW ORDER_.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
          Source: NEW ORDER_.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
          Source: NEW ORDER_.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: NEW ORDER_.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
          Source: NEW ORDER_.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
          Source: NEW ORDER_.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: ipconfig.pdb source: svchost.exe, 00000002.00000002.1374088105.0000000002C12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1373711081.0000000002C2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374368775.00000000031D0000.00000040.10000000.00040000.00000000.sdmp, ipconfig.exe, ipconfig.exe, 00000005.00000002.3748987818.0000000000ED0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: ipconfig.pdbGCTL source: svchost.exe, 00000002.00000002.1374088105.0000000002C12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1373711081.0000000002C2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374368775.00000000031D0000.00000040.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3748987818.0000000000ED0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: NEW ORDER_.exe, 00000000.00000003.1310978306.0000000003E30000.00000004.00001000.00020000.00000000.sdmp, NEW ORDER_.exe, 00000000.00000003.1311575770.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1318911457.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1320775755.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374502488.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374502488.0000000003300000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3750816101.00000000034B0000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3750816101.000000000364E000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000003.1376396175.000000000330A000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000003.1374209665.0000000003148000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: NEW ORDER_.exe, 00000000.00000003.1310978306.0000000003E30000.00000004.00001000.00020000.00000000.sdmp, NEW ORDER_.exe, 00000000.00000003.1311575770.0000000003FD0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1318911457.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1320775755.0000000003100000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374502488.000000000349E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1374502488.0000000003300000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, ipconfig.exe, 00000005.00000002.3750816101.00000000034B0000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3750816101.000000000364E000.00000040.00001000.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000003.1376396175.000000000330A000.00000004.00000020.00020000.00000000.sdmp, ipconfig.exe, 00000005.00000003.1374209665.0000000003148000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: svchost.pdb source: explorer.exe, 00000004.00000002.2404877912.0000000010B1F000.00000004.80000000.00040000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3752195836.00000000039FF000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3749463893.0000000003052000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3766323699.000000000A37F000.00000004.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdbUGP source: explorer.exe, 00000004.00000002.2404877912.0000000010B1F000.00000004.80000000.00040000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3752195836.00000000039FF000.00000004.10000000.00040000.00000000.sdmp, ipconfig.exe, 00000005.00000002.3749463893.0000000003052000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3766323699.000000000A37F000.00000004.80000000.00040000.00000000.sdmp
          Source: NEW ORDER_.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
          Source: NEW ORDER_.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
          Source: NEW ORDER_.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
          Source: NEW ORDER_.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
          Source: NEW ORDER_.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0070E01E LoadLibraryA,GetProcAddress,0_2_0070E01E
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0070288B push 66007023h; retn 0076h0_2_007028E1
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00716B05 push ecx; ret 0_2_00716B18
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_015B4ADF push edx; ret 0_2_015B4AF3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041285C push cs; retf 2_2_0041285F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417008 pushfd ; retf 2_2_0041700F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004171EF push ds; iretd 2_2_004171FD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E992 push dword ptr [08CCB4BEh]; ret 2_2_0041E9AA
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E9B2 push dword ptr [0ECCDC24h]; ret 2_2_0041EACE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416A81 pushfd ; retf 2_2_00416A82
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417ABC push edi; ret 2_2_00417ABD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E46D push ebx; retf 2_2_0040E470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D475 push eax; ret 2_2_0041D4C8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D4C2 push eax; ret 2_2_0041D4C8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D4CB push eax; ret 2_2_0041D532
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D52C push eax; ret 2_2_0041D532
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E530 push edi; ret 2_2_0041E532
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004177BF push B417C20Bh; ret 2_2_004177C4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330225F pushad ; ret 2_2_033027F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033027FA pushad ; ret 2_2_033027F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033309AD push ecx; mov dword ptr [esp], ecx2_2_033309B6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0330283D push eax; iretd 2_2_03302858
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0321EB02 push esp; retn 0000h2_2_0321EB03
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0321EB1E push esp; retn 0000h2_2_0321EB1F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0321E9B5 push esp; retn 0000h2_2_0321EAE7
          Source: C:\Windows\explorer.exeCode function: 4_2_0E45BB02 push esp; retn 0000h4_2_0E45BB03
          Source: C:\Windows\explorer.exeCode function: 4_2_0E45BB1E push esp; retn 0000h4_2_0E45BB1F
          Source: C:\Windows\explorer.exeCode function: 4_2_0E45B9B5 push esp; retn 0000h4_2_0E45BAE7
          Source: C:\Windows\explorer.exeCode function: 4_2_108729B5 push esp; retn 0000h4_2_10872AE7
          Source: C:\Windows\explorer.exeCode function: 4_2_10872B02 push esp; retn 0000h4_2_10872B03
          Source: C:\Windows\explorer.exeCode function: 4_2_10872B1E push esp; retn 0000h4_2_10872B1F
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00ED570D push ecx; ret 5_2_00ED5720

          Persistence and Installation Behavior

          barindex
          Uses ipconfig to lookup or modify the Windows network settings
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe "C:\Windows\SysWOW64\ipconfig.exe"
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00758111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00758111
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0070EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_0070EB42
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0071123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_0071123A
          Source: C:\Users\user\Desktop\NEW ORDER_.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Query firmware table information (likely to detect VMs)
          Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformation
          Reads the DNS cache
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00ED3872 DnsGetCacheDataTableEx,DnsFree,DnsFree,5_2_00ED3872
          Switches to a custom stack to bypass stack traces
          Source: C:\Users\user\Desktop\NEW ORDER_.exeAPI/Special instruction interceptor: Address: 15B449C
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Source: C:\Windows\SysWOW64\ipconfig.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Windows\SysWOW64\ipconfig.exeAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Windows\SysWOW64\ipconfig.exeAPI/Special instruction interceptor: Address: 7FFB2CECD944
          Source: C:\Windows\SysWOW64\ipconfig.exeAPI/Special instruction interceptor: Address: 7FFB2CECD504
          Source: C:\Windows\SysWOW64\ipconfig.exeAPI/Special instruction interceptor: Address: 7FFB2CECD544
          Source: C:\Windows\SysWOW64\ipconfig.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Source: C:\Windows\SysWOW64\ipconfig.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Windows\SysWOW64\ipconfig.exeAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Windows\SysWOW64\ipconfig.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Windows\SysWOW64\svchost.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\svchost.exeRDTSC instruction interceptor: First address: 409B6E second address: 409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\ipconfig.exeRDTSC instruction interceptor: First address: C99904 second address: C9990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\ipconfig.exeRDTSC instruction interceptor: First address: C99B6E second address: C99B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\explorer.exeFile opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409AA0 rdtsc 2_2_00409AA0
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 9782Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 880Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 873Jump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeWindow / User API: threadDelayed 698Jump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeWindow / User API: threadDelayed 9274Jump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-94088
          Source: C:\Users\user\Desktop\NEW ORDER_.exeAPI coverage: 5.7 %
          Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 2.1 %
          Source: C:\Windows\SysWOW64\ipconfig.exeAPI coverage: 1.9 %
          Source: C:\Windows\explorer.exe TID: 7880Thread sleep count: 9782 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 7880Thread sleep time: -19564000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 7880Thread sleep count: 162 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 7880Thread sleep time: -324000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exe TID: 7788Thread sleep count: 698 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exe TID: 7788Thread sleep time: -1396000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exe TID: 7788Thread sleep count: 9274 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exe TID: 7788Thread sleep time: -18548000s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00736CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00736CA9
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007360DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_007360DD
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007363F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_007363F9
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0073EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0073EB60
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0073F56F FindFirstFileW,FindClose,0_2_0073F56F
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0073F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_0073F5FA
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00741B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00741B2F
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00741C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00741C8A
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00741F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00741F94
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0070DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0070DDC0
          Source: explorer.exe, 0000000E.00000003.2509700146.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\m<
          Source: explorer.exe, 00000004.00000000.1323423529.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
          Source: explorer.exe, 0000000E.00000003.2450949413.0000000009A61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
          Source: explorer.exe, 0000000E.00000003.2391794163.0000000007BB1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
          Source: explorer.exe, 0000000E.00000003.2394648634.0000000007BE4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\4
          Source: explorer.exe, 0000000E.00000003.2389058512.0000000007B72000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&00000k
          Source: explorer.exe, 00000004.00000000.1327589479.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2387608443.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2451435306.0000000009B33000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2441823724.0000000009B2E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2446303633.0000000009B33000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3764000347.0000000009B26000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3698685262.0000000009B26000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2466769749.0000000009B26000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2442349755.0000000009B33000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2467538759.0000000009B26000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 0000000E.00000002.3748179691.00000000010C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000007
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
          Source: explorer.exe, 00000004.00000002.2380887172.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
          Source: explorer.exe, 0000000E.00000003.2450949413.0000000009A61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 0000000E.00000002.3769483542.000000000C89C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
          Source: explorer.exe, 0000000E.00000003.2514697880.000000000C7FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_
          Source: explorer.exe, 00000004.00000002.2387608443.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
          Source: explorer.exe, 00000004.00000002.2389749148.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
          Source: explorer.exe, 00000004.00000002.2387608443.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000C9B8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
          Source: explorer.exe, 0000000E.00000003.2450949413.0000000009A61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4NECVMWar VMware SATA CD00
          Source: explorer.exe, 0000000E.00000003.2514697880.000000000C7FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:s
          Source: explorer.exe, 00000004.00000002.2380887172.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware20,1
          Source: explorer.exe, 0000000E.00000003.2509700146.000000000C8B1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}t
          Source: explorer.exe, 0000000E.00000003.2514697880.000000000C7FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
          Source: explorer.exe, 00000004.00000003.2274116897.000000000730A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
          Source: explorer.exe, 00000004.00000000.1327589479.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2387608443.0000000008F27000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWT`
          Source: explorer.exe, 0000000E.00000003.2509700146.000000000C8B1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000E.00000002.3769483542.000000000C745000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}erActiU
          Source: explorer.exe, 00000004.00000002.2380887172.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
          Source: explorer.exe, 00000004.00000002.2380887172.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\|<
          Source: explorer.exe, 00000004.00000002.2380887172.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
          Source: explorer.exe, 0000000E.00000002.3769483542.000000000C745000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000E.00000003.2394648634.0000000007BE4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}
          Source: explorer.exe, 0000000E.00000002.3769483542.000000000C916000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000Zp
          Source: explorer.exe, 00000004.00000002.2380887172.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
          Source: explorer.exe, 0000000E.00000002.3764000347.0000000009AE8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3698685262.0000000009AE8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2441823724.0000000009AE6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2440790966.0000000009AE5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2466769749.0000000009AE8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
          Source: explorer.exe, 0000000E.00000003.2394648634.0000000007BE4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\!;A&2
          Source: explorer.exe, 0000000E.00000003.3698685262.0000000009913000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3764000347.0000000009916000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-GB\input.inf_loc
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}\S<
          Source: explorer.exe, 00000004.00000002.2380887172.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
          Source: explorer.exe, 0000000E.00000002.3748179691.00000000010C9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000z
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}''B
          Source: explorer.exe, 00000004.00000002.2380887172.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
          Source: explorer.exe, 00000004.00000003.2274116897.000000000730A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_xU1
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b},>\'
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@8
          Source: explorer.exe, 0000000E.00000002.3769483542.000000000C916000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000E.00000003.2394607629.00000000098E2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}a
          Source: explorer.exe, 00000004.00000000.1327589479.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2387608443.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
          Source: explorer.exe, 0000000E.00000002.3753814442.0000000007B72000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NXTVMWare
          Source: explorer.exe, 00000004.00000002.2380887172.0000000003249000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}9507e
          Source: explorer.exe, 00000004.00000002.2387608443.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMWare
          Source: explorer.exe, 00000004.00000002.2389749148.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
          Source: explorer.exe, 0000000E.00000003.2515481085.000000000CA03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000004.00000000.1323423529.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
          Source: C:\Users\user\Desktop\NEW ORDER_.exeAPI call chain: ExitProcess graph end nodegraph_0-93306
          Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\explorer.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\explorer.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409AA0 rdtsc 2_2_00409AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040ACE0 LdrLoadDll,2_2_0040ACE0
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00746AAF BlockInput,0_2_00746AAF
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006F3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_006F3D19
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00723920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,0_2_00723920
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0070E01E LoadLibraryA,GetProcAddress,0_2_0070E01E
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_015B30C8 mov eax, dword ptr fs:[00000030h]0_2_015B30C8
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_015B4768 mov eax, dword ptr fs:[00000030h]0_2_015B4768
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_015B4708 mov eax, dword ptr fs:[00000030h]0_2_015B4708
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0340634F mov eax, dword ptr fs:[00000030h]2_2_0340634F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332C310 mov ecx, dword ptr fs:[00000030h]2_2_0332C310
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03350310 mov ecx, dword ptr fs:[00000030h]2_2_03350310
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A30B mov eax, dword ptr fs:[00000030h]2_2_0336A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A30B mov eax, dword ptr fs:[00000030h]2_2_0336A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A30B mov eax, dword ptr fs:[00000030h]2_2_0336A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D437C mov eax, dword ptr fs:[00000030h]2_2_033D437C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03408324 mov eax, dword ptr fs:[00000030h]2_2_03408324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03408324 mov ecx, dword ptr fs:[00000030h]2_2_03408324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03408324 mov eax, dword ptr fs:[00000030h]2_2_03408324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03408324 mov eax, dword ptr fs:[00000030h]2_2_03408324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov eax, dword ptr fs:[00000030h]2_2_033B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov eax, dword ptr fs:[00000030h]2_2_033B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov eax, dword ptr fs:[00000030h]2_2_033B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov ecx, dword ptr fs:[00000030h]2_2_033B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov eax, dword ptr fs:[00000030h]2_2_033B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B035C mov eax, dword ptr fs:[00000030h]2_2_033B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FA352 mov eax, dword ptr fs:[00000030h]2_2_033FA352
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D8350 mov ecx, dword ptr fs:[00000030h]2_2_033D8350
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B2349 mov eax, dword ptr fs:[00000030h]2_2_033B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328397 mov eax, dword ptr fs:[00000030h]2_2_03328397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328397 mov eax, dword ptr fs:[00000030h]2_2_03328397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328397 mov eax, dword ptr fs:[00000030h]2_2_03328397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E388 mov eax, dword ptr fs:[00000030h]2_2_0332E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E388 mov eax, dword ptr fs:[00000030h]2_2_0332E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E388 mov eax, dword ptr fs:[00000030h]2_2_0332E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335438F mov eax, dword ptr fs:[00000030h]2_2_0335438F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335438F mov eax, dword ptr fs:[00000030h]2_2_0335438F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E3F0 mov eax, dword ptr fs:[00000030h]2_2_0334E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E3F0 mov eax, dword ptr fs:[00000030h]2_2_0334E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E3F0 mov eax, dword ptr fs:[00000030h]2_2_0334E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033663FF mov eax, dword ptr fs:[00000030h]2_2_033663FF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033403E9 mov eax, dword ptr fs:[00000030h]2_2_033403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE3DB mov eax, dword ptr fs:[00000030h]2_2_033DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE3DB mov eax, dword ptr fs:[00000030h]2_2_033DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE3DB mov ecx, dword ptr fs:[00000030h]2_2_033DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE3DB mov eax, dword ptr fs:[00000030h]2_2_033DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D43D4 mov eax, dword ptr fs:[00000030h]2_2_033D43D4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D43D4 mov eax, dword ptr fs:[00000030h]2_2_033D43D4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EC3CD mov eax, dword ptr fs:[00000030h]2_2_033EC3CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A3C0 mov eax, dword ptr fs:[00000030h]2_2_0333A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033383C0 mov eax, dword ptr fs:[00000030h]2_2_033383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033383C0 mov eax, dword ptr fs:[00000030h]2_2_033383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033383C0 mov eax, dword ptr fs:[00000030h]2_2_033383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033383C0 mov eax, dword ptr fs:[00000030h]2_2_033383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B63C0 mov eax, dword ptr fs:[00000030h]2_2_033B63C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332823B mov eax, dword ptr fs:[00000030h]2_2_0332823B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0340625D mov eax, dword ptr fs:[00000030h]2_2_0340625D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E0274 mov eax, dword ptr fs:[00000030h]2_2_033E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03334260 mov eax, dword ptr fs:[00000030h]2_2_03334260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03334260 mov eax, dword ptr fs:[00000030h]2_2_03334260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03334260 mov eax, dword ptr fs:[00000030h]2_2_03334260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332826B mov eax, dword ptr fs:[00000030h]2_2_0332826B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A250 mov eax, dword ptr fs:[00000030h]2_2_0332A250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336259 mov eax, dword ptr fs:[00000030h]2_2_03336259
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EA250 mov eax, dword ptr fs:[00000030h]2_2_033EA250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EA250 mov eax, dword ptr fs:[00000030h]2_2_033EA250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B8243 mov eax, dword ptr fs:[00000030h]2_2_033B8243
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B8243 mov ecx, dword ptr fs:[00000030h]2_2_033B8243
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033402A0 mov eax, dword ptr fs:[00000030h]2_2_033402A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033402A0 mov eax, dword ptr fs:[00000030h]2_2_033402A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034062D6 mov eax, dword ptr fs:[00000030h]2_2_034062D6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov eax, dword ptr fs:[00000030h]2_2_033C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov ecx, dword ptr fs:[00000030h]2_2_033C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov eax, dword ptr fs:[00000030h]2_2_033C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov eax, dword ptr fs:[00000030h]2_2_033C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov eax, dword ptr fs:[00000030h]2_2_033C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C62A0 mov eax, dword ptr fs:[00000030h]2_2_033C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E284 mov eax, dword ptr fs:[00000030h]2_2_0336E284
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E284 mov eax, dword ptr fs:[00000030h]2_2_0336E284
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B0283 mov eax, dword ptr fs:[00000030h]2_2_033B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B0283 mov eax, dword ptr fs:[00000030h]2_2_033B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B0283 mov eax, dword ptr fs:[00000030h]2_2_033B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033402E1 mov eax, dword ptr fs:[00000030h]2_2_033402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033402E1 mov eax, dword ptr fs:[00000030h]2_2_033402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033402E1 mov eax, dword ptr fs:[00000030h]2_2_033402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A2C3 mov eax, dword ptr fs:[00000030h]2_2_0333A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A2C3 mov eax, dword ptr fs:[00000030h]2_2_0333A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A2C3 mov eax, dword ptr fs:[00000030h]2_2_0333A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A2C3 mov eax, dword ptr fs:[00000030h]2_2_0333A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A2C3 mov eax, dword ptr fs:[00000030h]2_2_0333A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03360124 mov eax, dword ptr fs:[00000030h]2_2_03360124
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404164 mov eax, dword ptr fs:[00000030h]2_2_03404164
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404164 mov eax, dword ptr fs:[00000030h]2_2_03404164
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DA118 mov ecx, dword ptr fs:[00000030h]2_2_033DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DA118 mov eax, dword ptr fs:[00000030h]2_2_033DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DA118 mov eax, dword ptr fs:[00000030h]2_2_033DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DA118 mov eax, dword ptr fs:[00000030h]2_2_033DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F0115 mov eax, dword ptr fs:[00000030h]2_2_033F0115
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov ecx, dword ptr fs:[00000030h]2_2_033DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov ecx, dword ptr fs:[00000030h]2_2_033DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov ecx, dword ptr fs:[00000030h]2_2_033DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov eax, dword ptr fs:[00000030h]2_2_033DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DE10E mov ecx, dword ptr fs:[00000030h]2_2_033DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332C156 mov eax, dword ptr fs:[00000030h]2_2_0332C156
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C8158 mov eax, dword ptr fs:[00000030h]2_2_033C8158
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336154 mov eax, dword ptr fs:[00000030h]2_2_03336154
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336154 mov eax, dword ptr fs:[00000030h]2_2_03336154
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C4144 mov eax, dword ptr fs:[00000030h]2_2_033C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C4144 mov eax, dword ptr fs:[00000030h]2_2_033C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C4144 mov ecx, dword ptr fs:[00000030h]2_2_033C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C4144 mov eax, dword ptr fs:[00000030h]2_2_033C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C4144 mov eax, dword ptr fs:[00000030h]2_2_033C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B019F mov eax, dword ptr fs:[00000030h]2_2_033B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B019F mov eax, dword ptr fs:[00000030h]2_2_033B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B019F mov eax, dword ptr fs:[00000030h]2_2_033B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B019F mov eax, dword ptr fs:[00000030h]2_2_033B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A197 mov eax, dword ptr fs:[00000030h]2_2_0332A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A197 mov eax, dword ptr fs:[00000030h]2_2_0332A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A197 mov eax, dword ptr fs:[00000030h]2_2_0332A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034061E5 mov eax, dword ptr fs:[00000030h]2_2_034061E5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03370185 mov eax, dword ptr fs:[00000030h]2_2_03370185
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EC188 mov eax, dword ptr fs:[00000030h]2_2_033EC188
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EC188 mov eax, dword ptr fs:[00000030h]2_2_033EC188
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D4180 mov eax, dword ptr fs:[00000030h]2_2_033D4180
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D4180 mov eax, dword ptr fs:[00000030h]2_2_033D4180
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033601F8 mov eax, dword ptr fs:[00000030h]2_2_033601F8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE1D0 mov eax, dword ptr fs:[00000030h]2_2_033AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE1D0 mov eax, dword ptr fs:[00000030h]2_2_033AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_033AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE1D0 mov eax, dword ptr fs:[00000030h]2_2_033AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE1D0 mov eax, dword ptr fs:[00000030h]2_2_033AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F61C3 mov eax, dword ptr fs:[00000030h]2_2_033F61C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F61C3 mov eax, dword ptr fs:[00000030h]2_2_033F61C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C6030 mov eax, dword ptr fs:[00000030h]2_2_033C6030
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A020 mov eax, dword ptr fs:[00000030h]2_2_0332A020
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332C020 mov eax, dword ptr fs:[00000030h]2_2_0332C020
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E016 mov eax, dword ptr fs:[00000030h]2_2_0334E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E016 mov eax, dword ptr fs:[00000030h]2_2_0334E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E016 mov eax, dword ptr fs:[00000030h]2_2_0334E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E016 mov eax, dword ptr fs:[00000030h]2_2_0334E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B4000 mov ecx, dword ptr fs:[00000030h]2_2_033B4000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D2000 mov eax, dword ptr fs:[00000030h]2_2_033D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335C073 mov eax, dword ptr fs:[00000030h]2_2_0335C073
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03332050 mov eax, dword ptr fs:[00000030h]2_2_03332050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6050 mov eax, dword ptr fs:[00000030h]2_2_033B6050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F60B8 mov eax, dword ptr fs:[00000030h]2_2_033F60B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F60B8 mov ecx, dword ptr fs:[00000030h]2_2_033F60B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033280A0 mov eax, dword ptr fs:[00000030h]2_2_033280A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C80A8 mov eax, dword ptr fs:[00000030h]2_2_033C80A8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333208A mov eax, dword ptr fs:[00000030h]2_2_0333208A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332C0F0 mov eax, dword ptr fs:[00000030h]2_2_0332C0F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033720F0 mov ecx, dword ptr fs:[00000030h]2_2_033720F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0332A0E3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033380E9 mov eax, dword ptr fs:[00000030h]2_2_033380E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B60E0 mov eax, dword ptr fs:[00000030h]2_2_033B60E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B20DE mov eax, dword ptr fs:[00000030h]2_2_033B20DE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336273C mov eax, dword ptr fs:[00000030h]2_2_0336273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336273C mov ecx, dword ptr fs:[00000030h]2_2_0336273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336273C mov eax, dword ptr fs:[00000030h]2_2_0336273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AC730 mov eax, dword ptr fs:[00000030h]2_2_033AC730
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C720 mov eax, dword ptr fs:[00000030h]2_2_0336C720
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C720 mov eax, dword ptr fs:[00000030h]2_2_0336C720
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330710 mov eax, dword ptr fs:[00000030h]2_2_03330710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03360710 mov eax, dword ptr fs:[00000030h]2_2_03360710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C700 mov eax, dword ptr fs:[00000030h]2_2_0336C700
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338770 mov eax, dword ptr fs:[00000030h]2_2_03338770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340770 mov eax, dword ptr fs:[00000030h]2_2_03340770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330750 mov eax, dword ptr fs:[00000030h]2_2_03330750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BE75D mov eax, dword ptr fs:[00000030h]2_2_033BE75D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372750 mov eax, dword ptr fs:[00000030h]2_2_03372750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372750 mov eax, dword ptr fs:[00000030h]2_2_03372750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B4755 mov eax, dword ptr fs:[00000030h]2_2_033B4755
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336674D mov esi, dword ptr fs:[00000030h]2_2_0336674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336674D mov eax, dword ptr fs:[00000030h]2_2_0336674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336674D mov eax, dword ptr fs:[00000030h]2_2_0336674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033307AF mov eax, dword ptr fs:[00000030h]2_2_033307AF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E47A0 mov eax, dword ptr fs:[00000030h]2_2_033E47A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D678E mov eax, dword ptr fs:[00000030h]2_2_033D678E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033347FB mov eax, dword ptr fs:[00000030h]2_2_033347FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033347FB mov eax, dword ptr fs:[00000030h]2_2_033347FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033527ED mov eax, dword ptr fs:[00000030h]2_2_033527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033527ED mov eax, dword ptr fs:[00000030h]2_2_033527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033527ED mov eax, dword ptr fs:[00000030h]2_2_033527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BE7E1 mov eax, dword ptr fs:[00000030h]2_2_033BE7E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333C7C0 mov eax, dword ptr fs:[00000030h]2_2_0333C7C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B07C3 mov eax, dword ptr fs:[00000030h]2_2_033B07C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334E627 mov eax, dword ptr fs:[00000030h]2_2_0334E627
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03366620 mov eax, dword ptr fs:[00000030h]2_2_03366620
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03368620 mov eax, dword ptr fs:[00000030h]2_2_03368620
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333262C mov eax, dword ptr fs:[00000030h]2_2_0333262C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03372619 mov eax, dword ptr fs:[00000030h]2_2_03372619
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE609 mov eax, dword ptr fs:[00000030h]2_2_033AE609
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334260B mov eax, dword ptr fs:[00000030h]2_2_0334260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03362674 mov eax, dword ptr fs:[00000030h]2_2_03362674
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F866E mov eax, dword ptr fs:[00000030h]2_2_033F866E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F866E mov eax, dword ptr fs:[00000030h]2_2_033F866E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A660 mov eax, dword ptr fs:[00000030h]2_2_0336A660
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A660 mov eax, dword ptr fs:[00000030h]2_2_0336A660
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0334C640 mov eax, dword ptr fs:[00000030h]2_2_0334C640
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033666B0 mov eax, dword ptr fs:[00000030h]2_2_033666B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C6A6 mov eax, dword ptr fs:[00000030h]2_2_0336C6A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03334690 mov eax, dword ptr fs:[00000030h]2_2_03334690
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03334690 mov eax, dword ptr fs:[00000030h]2_2_03334690
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE6F2 mov eax, dword ptr fs:[00000030h]2_2_033AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE6F2 mov eax, dword ptr fs:[00000030h]2_2_033AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE6F2 mov eax, dword ptr fs:[00000030h]2_2_033AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE6F2 mov eax, dword ptr fs:[00000030h]2_2_033AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B06F1 mov eax, dword ptr fs:[00000030h]2_2_033B06F1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B06F1 mov eax, dword ptr fs:[00000030h]2_2_033B06F1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0336A6C7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A6C7 mov eax, dword ptr fs:[00000030h]2_2_0336A6C7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340535 mov eax, dword ptr fs:[00000030h]2_2_03340535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E53E mov eax, dword ptr fs:[00000030h]2_2_0335E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E53E mov eax, dword ptr fs:[00000030h]2_2_0335E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E53E mov eax, dword ptr fs:[00000030h]2_2_0335E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E53E mov eax, dword ptr fs:[00000030h]2_2_0335E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E53E mov eax, dword ptr fs:[00000030h]2_2_0335E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C6500 mov eax, dword ptr fs:[00000030h]2_2_033C6500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404500 mov eax, dword ptr fs:[00000030h]2_2_03404500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336656A mov eax, dword ptr fs:[00000030h]2_2_0336656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336656A mov eax, dword ptr fs:[00000030h]2_2_0336656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336656A mov eax, dword ptr fs:[00000030h]2_2_0336656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338550 mov eax, dword ptr fs:[00000030h]2_2_03338550
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338550 mov eax, dword ptr fs:[00000030h]2_2_03338550
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033545B1 mov eax, dword ptr fs:[00000030h]2_2_033545B1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033545B1 mov eax, dword ptr fs:[00000030h]2_2_033545B1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B05A7 mov eax, dword ptr fs:[00000030h]2_2_033B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B05A7 mov eax, dword ptr fs:[00000030h]2_2_033B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B05A7 mov eax, dword ptr fs:[00000030h]2_2_033B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E59C mov eax, dword ptr fs:[00000030h]2_2_0336E59C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03332582 mov eax, dword ptr fs:[00000030h]2_2_03332582
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03332582 mov ecx, dword ptr fs:[00000030h]2_2_03332582
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03364588 mov eax, dword ptr fs:[00000030h]2_2_03364588
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335E5E7 mov eax, dword ptr fs:[00000030h]2_2_0335E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033325E0 mov eax, dword ptr fs:[00000030h]2_2_033325E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C5ED mov eax, dword ptr fs:[00000030h]2_2_0336C5ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336C5ED mov eax, dword ptr fs:[00000030h]2_2_0336C5ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033365D0 mov eax, dword ptr fs:[00000030h]2_2_033365D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A5D0 mov eax, dword ptr fs:[00000030h]2_2_0336A5D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A5D0 mov eax, dword ptr fs:[00000030h]2_2_0336A5D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E5CF mov eax, dword ptr fs:[00000030h]2_2_0336E5CF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E5CF mov eax, dword ptr fs:[00000030h]2_2_0336E5CF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A430 mov eax, dword ptr fs:[00000030h]2_2_0336A430
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E420 mov eax, dword ptr fs:[00000030h]2_2_0332E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E420 mov eax, dword ptr fs:[00000030h]2_2_0332E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332E420 mov eax, dword ptr fs:[00000030h]2_2_0332E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332C427 mov eax, dword ptr fs:[00000030h]2_2_0332C427
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B6420 mov eax, dword ptr fs:[00000030h]2_2_033B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03368402 mov eax, dword ptr fs:[00000030h]2_2_03368402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03368402 mov eax, dword ptr fs:[00000030h]2_2_03368402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03368402 mov eax, dword ptr fs:[00000030h]2_2_03368402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335A470 mov eax, dword ptr fs:[00000030h]2_2_0335A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335A470 mov eax, dword ptr fs:[00000030h]2_2_0335A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335A470 mov eax, dword ptr fs:[00000030h]2_2_0335A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BC460 mov ecx, dword ptr fs:[00000030h]2_2_033BC460
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EA456 mov eax, dword ptr fs:[00000030h]2_2_033EA456
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332645D mov eax, dword ptr fs:[00000030h]2_2_0332645D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335245A mov eax, dword ptr fs:[00000030h]2_2_0335245A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336E443 mov eax, dword ptr fs:[00000030h]2_2_0336E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033644B0 mov ecx, dword ptr fs:[00000030h]2_2_033644B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BA4B0 mov eax, dword ptr fs:[00000030h]2_2_033BA4B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033364AB mov eax, dword ptr fs:[00000030h]2_2_033364AB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033EA49A mov eax, dword ptr fs:[00000030h]2_2_033EA49A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033304E5 mov ecx, dword ptr fs:[00000030h]2_2_033304E5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335EB20 mov eax, dword ptr fs:[00000030h]2_2_0335EB20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335EB20 mov eax, dword ptr fs:[00000030h]2_2_0335EB20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F8B28 mov eax, dword ptr fs:[00000030h]2_2_033F8B28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033F8B28 mov eax, dword ptr fs:[00000030h]2_2_033F8B28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03402B57 mov eax, dword ptr fs:[00000030h]2_2_03402B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03402B57 mov eax, dword ptr fs:[00000030h]2_2_03402B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03402B57 mov eax, dword ptr fs:[00000030h]2_2_03402B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03402B57 mov eax, dword ptr fs:[00000030h]2_2_03402B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AEB1D mov eax, dword ptr fs:[00000030h]2_2_033AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404B00 mov eax, dword ptr fs:[00000030h]2_2_03404B00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0332CB7E mov eax, dword ptr fs:[00000030h]2_2_0332CB7E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328B50 mov eax, dword ptr fs:[00000030h]2_2_03328B50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DEB50 mov eax, dword ptr fs:[00000030h]2_2_033DEB50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E4B4B mov eax, dword ptr fs:[00000030h]2_2_033E4B4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E4B4B mov eax, dword ptr fs:[00000030h]2_2_033E4B4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C6B40 mov eax, dword ptr fs:[00000030h]2_2_033C6B40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C6B40 mov eax, dword ptr fs:[00000030h]2_2_033C6B40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FAB40 mov eax, dword ptr fs:[00000030h]2_2_033FAB40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D8B42 mov eax, dword ptr fs:[00000030h]2_2_033D8B42
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340BBE mov eax, dword ptr fs:[00000030h]2_2_03340BBE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340BBE mov eax, dword ptr fs:[00000030h]2_2_03340BBE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E4BB0 mov eax, dword ptr fs:[00000030h]2_2_033E4BB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033E4BB0 mov eax, dword ptr fs:[00000030h]2_2_033E4BB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338BF0 mov eax, dword ptr fs:[00000030h]2_2_03338BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338BF0 mov eax, dword ptr fs:[00000030h]2_2_03338BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338BF0 mov eax, dword ptr fs:[00000030h]2_2_03338BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335EBFC mov eax, dword ptr fs:[00000030h]2_2_0335EBFC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BCBF0 mov eax, dword ptr fs:[00000030h]2_2_033BCBF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DEBD0 mov eax, dword ptr fs:[00000030h]2_2_033DEBD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03350BCB mov eax, dword ptr fs:[00000030h]2_2_03350BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03350BCB mov eax, dword ptr fs:[00000030h]2_2_03350BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03350BCB mov eax, dword ptr fs:[00000030h]2_2_03350BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330BCD mov eax, dword ptr fs:[00000030h]2_2_03330BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330BCD mov eax, dword ptr fs:[00000030h]2_2_03330BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330BCD mov eax, dword ptr fs:[00000030h]2_2_03330BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03354A35 mov eax, dword ptr fs:[00000030h]2_2_03354A35
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03354A35 mov eax, dword ptr fs:[00000030h]2_2_03354A35
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336CA38 mov eax, dword ptr fs:[00000030h]2_2_0336CA38
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336CA24 mov eax, dword ptr fs:[00000030h]2_2_0336CA24
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0335EA2E mov eax, dword ptr fs:[00000030h]2_2_0335EA2E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BCA11 mov eax, dword ptr fs:[00000030h]2_2_033BCA11
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033ACA72 mov eax, dword ptr fs:[00000030h]2_2_033ACA72
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033ACA72 mov eax, dword ptr fs:[00000030h]2_2_033ACA72
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336CA6F mov eax, dword ptr fs:[00000030h]2_2_0336CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336CA6F mov eax, dword ptr fs:[00000030h]2_2_0336CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336CA6F mov eax, dword ptr fs:[00000030h]2_2_0336CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033DEA60 mov eax, dword ptr fs:[00000030h]2_2_033DEA60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03336A50 mov eax, dword ptr fs:[00000030h]2_2_03336A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340A5B mov eax, dword ptr fs:[00000030h]2_2_03340A5B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03340A5B mov eax, dword ptr fs:[00000030h]2_2_03340A5B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338AA0 mov eax, dword ptr fs:[00000030h]2_2_03338AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03338AA0 mov eax, dword ptr fs:[00000030h]2_2_03338AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03386AA4 mov eax, dword ptr fs:[00000030h]2_2_03386AA4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03368A90 mov edx, dword ptr fs:[00000030h]2_2_03368A90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333EA80 mov eax, dword ptr fs:[00000030h]2_2_0333EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404A80 mov eax, dword ptr fs:[00000030h]2_2_03404A80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336AAEE mov eax, dword ptr fs:[00000030h]2_2_0336AAEE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336AAEE mov eax, dword ptr fs:[00000030h]2_2_0336AAEE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03330AD0 mov eax, dword ptr fs:[00000030h]2_2_03330AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03364AD0 mov eax, dword ptr fs:[00000030h]2_2_03364AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03364AD0 mov eax, dword ptr fs:[00000030h]2_2_03364AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03386ACC mov eax, dword ptr fs:[00000030h]2_2_03386ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03386ACC mov eax, dword ptr fs:[00000030h]2_2_03386ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03386ACC mov eax, dword ptr fs:[00000030h]2_2_03386ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03404940 mov eax, dword ptr fs:[00000030h]2_2_03404940
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B892A mov eax, dword ptr fs:[00000030h]2_2_033B892A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C892B mov eax, dword ptr fs:[00000030h]2_2_033C892B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BC912 mov eax, dword ptr fs:[00000030h]2_2_033BC912
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328918 mov eax, dword ptr fs:[00000030h]2_2_03328918
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03328918 mov eax, dword ptr fs:[00000030h]2_2_03328918
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE908 mov eax, dword ptr fs:[00000030h]2_2_033AE908
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033AE908 mov eax, dword ptr fs:[00000030h]2_2_033AE908
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D4978 mov eax, dword ptr fs:[00000030h]2_2_033D4978
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D4978 mov eax, dword ptr fs:[00000030h]2_2_033D4978
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BC97C mov eax, dword ptr fs:[00000030h]2_2_033BC97C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03356962 mov eax, dword ptr fs:[00000030h]2_2_03356962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03356962 mov eax, dword ptr fs:[00000030h]2_2_03356962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03356962 mov eax, dword ptr fs:[00000030h]2_2_03356962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0337096E mov eax, dword ptr fs:[00000030h]2_2_0337096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0337096E mov edx, dword ptr fs:[00000030h]2_2_0337096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0337096E mov eax, dword ptr fs:[00000030h]2_2_0337096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B0946 mov eax, dword ptr fs:[00000030h]2_2_033B0946
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B89B3 mov esi, dword ptr fs:[00000030h]2_2_033B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B89B3 mov eax, dword ptr fs:[00000030h]2_2_033B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033B89B3 mov eax, dword ptr fs:[00000030h]2_2_033B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033429A0 mov eax, dword ptr fs:[00000030h]2_2_033429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033309AD mov eax, dword ptr fs:[00000030h]2_2_033309AD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033309AD mov eax, dword ptr fs:[00000030h]2_2_033309AD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033629F9 mov eax, dword ptr fs:[00000030h]2_2_033629F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033629F9 mov eax, dword ptr fs:[00000030h]2_2_033629F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BE9E0 mov eax, dword ptr fs:[00000030h]2_2_033BE9E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0333A9D0 mov eax, dword ptr fs:[00000030h]2_2_0333A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033649D0 mov eax, dword ptr fs:[00000030h]2_2_033649D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033FA9D3 mov eax, dword ptr fs:[00000030h]2_2_033FA9D3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033C69C0 mov eax, dword ptr fs:[00000030h]2_2_033C69C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov eax, dword ptr fs:[00000030h]2_2_03352835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov eax, dword ptr fs:[00000030h]2_2_03352835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov eax, dword ptr fs:[00000030h]2_2_03352835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov ecx, dword ptr fs:[00000030h]2_2_03352835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov eax, dword ptr fs:[00000030h]2_2_03352835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03352835 mov eax, dword ptr fs:[00000030h]2_2_03352835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0336A830 mov eax, dword ptr fs:[00000030h]2_2_0336A830
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D483A mov eax, dword ptr fs:[00000030h]2_2_033D483A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033D483A mov eax, dword ptr fs:[00000030h]2_2_033D483A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BC810 mov eax, dword ptr fs:[00000030h]2_2_033BC810
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_033BE872 mov eax, dword ptr fs:[00000030h]2_2_033BE872
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0072A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_0072A66C
          Source: C:\Windows\SysWOW64\svchost.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007181AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_007181AC
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00718189 SetUnhandledExceptionFilter,0_2_00718189
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00ED53F0 SetUnhandledExceptionFilter,5_2_00ED53F0
          Source: C:\Windows\SysWOW64\ipconfig.exeCode function: 5_2_00ED51A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_00ED51A0

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\NEW ORDER_.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Windows\SysWOW64\svchost.exeThread register set: target process: 4056Jump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeThread register set: target process: 4056Jump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Windows\SysWOW64\svchost.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Windows\SysWOW64\svchost.exeSection unmapped: C:\Windows\SysWOW64\ipconfig.exe base address: ED0000Jump to behavior
          Writes to foreign memory regions
          Source: C:\Users\user\Desktop\NEW ORDER_.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2959008Jump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0072B106 LogonUserW,0_2_0072B106
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_006F3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_006F3D19
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0073411C SendInput,keybd_event,0_2_0073411C
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007374E7 mouse_event,0_2_007374E7
          Source: C:\Users\user\Desktop\NEW ORDER_.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\NEW ORDER_.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\ipconfig.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"Jump to behavior
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0072A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_0072A66C
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007371FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_007371FA
          Source: NEW ORDER_.exe, explorer.exe, 00000004.00000002.2382306208.0000000004880000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2272662739.0000000009013000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274146619.000000000901E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000004.00000000.1323862645.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.3748179691.00000000010C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753722338.0000000005180000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000004.00000000.1323862645.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
          Source: explorer.exe, 00000004.00000000.1323423529.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2380190939.0000000000C59000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman
          Source: NEW ORDER_.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
          Source: explorer.exe, 00000004.00000000.1323862645.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_007165C4 cpuid 0_2_007165C4
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0074091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,0_2_0074091D
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0076B340 GetUserNameW,0_2_0076B340
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00721E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00721E8E
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0070DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0070DDC0
          Source: explorer.exe, 0000000E.00000003.2510429618.000000000C7F2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3769483542.000000000C745000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2514697880.000000000C7FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Program Files\Windows Defender\MSASCui.exe

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.NEW ORDER_.exe.3ab0000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.NEW ORDER_.exe.3ab0000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: NEW ORDER_.exeBinary or memory string: WIN_81
          Source: NEW ORDER_.exeBinary or memory string: WIN_XP
          Source: NEW ORDER_.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
          Source: NEW ORDER_.exeBinary or memory string: WIN_XPe
          Source: NEW ORDER_.exeBinary or memory string: WIN_VISTA
          Source: NEW ORDER_.exeBinary or memory string: WIN_7
          Source: NEW ORDER_.exeBinary or memory string: WIN_8

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.NEW ORDER_.exe.3ab0000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.NEW ORDER_.exe.3ab0000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_00748C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_00748C4F
          Source: C:\Users\user\Desktop\NEW ORDER_.exeCode function: 0_2_0074923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_0074923B

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire Infrastructure2
          Valid Accounts          		2
          Native API          		1
          DLL Side-Loading          		1
          Exploitation for Privilege Escalation          		1
          Disable or Modify Tools          		11
          Input Capture          		2
          System Time Discovery          		Remote Services1
          Archive Collected Data          		1
          Ingress Tool Transfer          		Exfiltration Over Other Network Medium1
          System Shutdown/Reboot
          CredentialsDomainsDefault Accounts1
          Shared Modules          		2
          Valid Accounts          		1
          DLL Side-Loading          		1
          Deobfuscate/Decode Files or Information          		LSASS Memory1
          Account Discovery          		Remote Desktop Protocol11
          Input Capture          		1
          Encrypted Channel          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)2
          Valid Accounts          		2
          Obfuscated Files or Information          		Security Account Manager2
          File and Directory Discovery          		SMB/Windows Admin Shares3
          Clipboard Data          		1
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
          Access Token Manipulation          		1
          DLL Side-Loading          		NTDS215
          System Information Discovery          		Distributed Component Object ModelInput Capture11
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script512
          Process Injection          		1
          Masquerading          		LSA Secrets371
          Security Software Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
          Valid Accounts          		Cached Domain Credentials23
          Virtualization/Sandbox Evasion          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items23
          Virtualization/Sandbox Evasion          		DCSync3
          Process Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
          Access Token Manipulation          		Proc Filesystem11
          Application Window Discovery          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt512
          Process Injection          		/etc/passwd and /etc/shadow1
          System Owner/User Discovery          		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
          IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
          System Network Configuration Discovery          		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1560971 Sample: NEW ORDER_.exe Startdate: 22/11/2024 Architecture: WINDOWS Score: 100 32 www.reyhazeusa.shop 2->32 34 www.ostcanadantpl.top 2->34 36 3 other IPs or domains 2->36 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 7 other signatures 2->46 11 NEW ORDER_.exe 2 2->11         started        signatures3 process4 signatures5 58 Binary is likely a compiled AutoIt script file 11->58 60 Writes to foreign memory regions 11->60 62 Maps a DLL or memory area into another process 11->62 14 svchost.exe 11->14         started        process6 signatures7 64 Modifies the context of a thread in another process (thread injection) 14->64 66 Maps a DLL or memory area into another process 14->66 68 Sample uses process hollowing technique 14->68 70 3 other signatures 14->70 17 explorer.exe 30 1 14->17 injected process8 signatures9 38 Uses ipconfig to lookup or modify the Windows network settings 17->38 20 ipconfig.exe 17->20         started        23 WerFault.exe 21 17->23         started        process10 signatures11 48 Modifies the context of a thread in another process (thread injection) 20->48 50 Reads the DNS cache 20->50 52 Maps a DLL or memory area into another process 20->52 54 2 other signatures 20->54 25 explorer.exe 16 125 20->25         started        28 cmd.exe 1 20->28         started        process12 signatures13 56 Query firmware table information (likely to detect VMs) 25->56 30 conhost.exe 28->30         started        process14

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          NEW ORDER_.exe66%ReversingLabsWin32.Trojan.AutoitInject
          NEW ORDER_.exe100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.ivglass.xyzReferer:0%Avira URL Cloudsafe
          http://www.066iwx2t.shop/ge07/www.g18q11a.top0%Avira URL Cloudsafe
          http://www.yegle.net/ge07/www.066iwx2t.shop0%Avira URL Cloudsafe
          http://www.reyhazeusa.shop0%Avira URL Cloudsafe
          http://www.ehkd.top/ge07/www.ivglass.xyz0%Avira URL Cloudsafe
          http://www.ehkd.top/ge07/0%Avira URL Cloudsafe
          http://www.f7y2i9fgm.xyz/ge07/www.giyztm.xyz0%Avira URL Cloudsafe
          http://www.reyhazeusa.shopReferer:0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm-dark0%Avira URL Cloudsafe
          http://www.ivglass.xyz/ge07/0%Avira URL Cloudsafe
          http://www.yegle.net/ge07/0%Avira URL Cloudsafe
          http://www.dvle-father.xyz/ge07/www.yegle.net0%Avira URL Cloudsafe
          http://www.f7y2i9fgm.xyz0%Avira URL Cloudsafe
          http://www.ostcanadantpl.topReferer:0%Avira URL Cloudsafe
          http://www.acifictechnologycctv.net/ge07/0%Avira URL Cloudsafe
          http://www.ostcanadantpl.top/ge07/www.f7y2i9fgm.xyz0%Avira URL Cloudsafe
          http://www.nce-ystyx.xyz0%Avira URL Cloudsafe
          http://www.dvle-father.xyz0%Avira URL Cloudsafe
          http://www.9net88.net/ge07/www.dvle-father.xyz0%Avira URL Cloudsafe
          http://www.epehr.pics0%Avira URL Cloudsafe
          https://outlook.comOB0%Avira URL Cloudsafe
          http://www.ood-packaging-jobs-brasil.today/ge07/www.acifictechnologycctv.net0%Avira URL Cloudsafe
          http://www.ivglass.xyz/ge07/www.nce-ystyx.xyz0%Avira URL Cloudsafe
          http://www.ehkd.top0%Avira URL Cloudsafe
          http://www.ngeribe2.homes0%Avira URL Cloudsafe
          http://www.acifictechnologycctv.net/ge07/www.reyhazeusa.shop0%Avira URL Cloudsafe
          http://www.g18q11a.top/ge07/0%Avira URL Cloudsafe
          http://www.ood-packaging-jobs-brasil.today0%Avira URL Cloudsafe
          http://www.f7y2i9fgm.xyz/ge07/0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary0%Avira URL Cloudsafe
          http://www.reyhazeusa.shop/ge07/www.ostcanadantpl.top0%Avira URL Cloudsafe
          http://www.ostcanadantpl.top/ge07/0%Avira URL Cloudsafe
          http://www.epehr.pics/ge07/www.ngeribe2.homes0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm0%Avira URL Cloudsafe
          http://www.acifictechnologycctv.netReferer:0%Avira URL Cloudsafe
          http://www.g18q11a.topReferer:0%Avira URL Cloudsafe
          http://www.nce-ystyx.xyzReferer:0%Avira URL Cloudsafe
          http://www.066iwx2t.shopReferer:0%Avira URL Cloudsafe
          https://cdn.query.0%Avira URL Cloudsafe
          https://word.office.com%I0%Avira URL Cloudsafe
          http://www.dvle-father.xyzReferer:0%Avira URL Cloudsafe
          http://www.nce-ystyx.xyz/ge07/0%Avira URL Cloudsafe
          http://www.ehkd.topReferer:0%Avira URL Cloudsafe
          http://www.f7y2i9fgm.xyzReferer:0%Avira URL Cloudsafe
          http://www.giyztm.xyz/ge07/www.epehr.pics0%Avira URL Cloudsafe
          http://www.acifictechnologycctv.net0%Avira URL Cloudsafe
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAHG-dark0%Avira URL Cloudsafe
          http://www.g18q11a.top0%Avira URL Cloudsafe
          http://www.ostcanadantpl.top0%Avira URL Cloudsafe
          http://www.ngeribe2.homes/ge07/0%Avira URL Cloudsafe
          http://www.dvle-father.xyz/ge07/0%Avira URL Cloudsafe
          http://www.reyhazeusa.shop/ge07/0%Avira URL Cloudsafe
          http://www.epehr.pics/ge07/0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.acifictechnologycctv.net
          		unknown
          		unknowntrue
            		unknown
            www.reyhazeusa.shop
            		unknown
            		unknowntrue
              		unknown
              www.ostcanadantpl.top
              		unknown
              		unknowntrue
                		unknown
                api.msn.com
                		unknown
                		unknownfalse
                  		high
                  www.ood-packaging-jobs-brasil.today
                  		unknown
                  		unknowntrue
                    		unknown

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    www.9net88.net/ge07/false
                      		high

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm-darkexplorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://api.msn.com:443/v1/news/Feed/Windows?texplorer.exe, 00000004.00000000.1325301295.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2382491394.0000000007276000.00000004.00000001.00020000.00000000.sdmpfalse
                        		high
                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          http://www.066iwx2t.shop/ge07/www.g18q11a.topexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-worldexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winterexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://www.reyhazeusa.shopexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.ivglass.xyzReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://excel.office.comexplorer.exe, 00000004.00000002.2395472104.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1330403346.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2467440128.0000000009B49000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2468224390.0000000009B48000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2471104315.0000000009B42000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2472316992.0000000009B42000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.f7y2i9fgm.xyz/ge07/www.giyztm.xyzexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://www.msn.com/en-us/money/realestate/senator-questions-wexplorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.ehkd.top/ge07/www.ivglass.xyzexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.yegle.net/ge07/www.066iwx2t.shopexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.ehkd.top/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.giyztm.xyz/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.ivglass.xyz/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.reyhazeusa.shopReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.f7y2i9fgm.xyzexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.nce-ystyx.xyzexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.giyztm.xyzReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.dvle-father.xyz/ge07/www.yegle.netexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://www.msn.com/en-explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&ocexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.ostcanadantpl.top/ge07/www.f7y2i9fgm.xyzexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.ostcanadantpl.topReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.yegle.net/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.dvle-father.xyzexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://wns.windows.com/explorer.exe, 00000004.00000003.2274146619.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2389749148.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1327589479.00000000090F2000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.acifictechnologycctv.net/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.9net88.net/ge07/www.dvle-father.xyzexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.epehr.picsexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://word.office.comexplorer.exe, 00000004.00000002.2395472104.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1330403346.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.msn.com/en-us/play/games/bubblyexplorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://outlook.comOBexplorer.exe, 0000000E.00000003.2467440128.0000000009B49000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2468224390.0000000009B48000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2471104315.0000000009B42000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2472316992.0000000009B42000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.ood-packaging-jobs-brasil.today/ge07/www.acifictechnologycctv.netexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://www.ngeribe2.homesexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-darkexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://www.msn.com/en-us/play/gexplorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://api.msn.com:443/v1/news/Feed/Windows?=explorer.exe, 0000000E.00000003.2452509158.0000000009A61000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2440790966.0000000009A71000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2466769749.00000000099D2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3764000347.00000000099B4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3698685262.00000000099B4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2450949413.0000000009A61000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.ivglass.xyz/ge07/www.nce-ystyx.xyzexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://outlook.comexplorer.exe, 00000004.00000002.2395472104.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1330403346.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.ehkd.topexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.acifictechnologycctv.net/ge07/www.reyhazeusa.shopexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.g18q11a.top/ge07/explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.ood-packaging-jobs-brasil.todayexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://android.notify.windows.com/iOSexplorer.exe, 00000004.00000000.1327589479.000000000913F000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 00000004.00000000.1327589479.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://www.f7y2i9fgm.xyz/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://api.msn.com/v1/news/Feed/Windows??Kexplorer.exe, 0000000E.00000003.2466769749.00000000099D2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3764000347.00000000099B4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3698685262.00000000099B4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binaryexplorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 00000004.00000000.1327589479.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2387608443.0000000008F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://www.reyhazeusa.shop/ge07/www.ostcanadantpl.topexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actuaexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.epehr.pics/ge07/www.ngeribe2.homesexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.g18q11a.topReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaTexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://www.pollensense.com/explorer.exe, 00000004.00000000.1325301295.00000000071B2000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.9net88.netReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.ostcanadantpl.top/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/viexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-bexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://schemas.microexplorer.exe, 00000004.00000000.1327078946.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.2385993948.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.2385254686.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.3769483542.000000000C745000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://www.nce-ystyx.xyzReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.acifictechnologycctv.netReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINtexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBmexplorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          https://cdn.query.explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown
                                                                                          http://www.9net88.net/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-explorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://www.066iwx2t.shopReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://word.office.com%Iexplorer.exe, 0000000E.00000003.2467440128.0000000009B49000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2468224390.0000000009B48000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2471104315.0000000009B42000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2472316992.0000000009B42000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                http://www.nce-ystyx.xyz/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: safe
                                                                                                		unknown
                                                                                                https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-itexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://www.dvle-father.xyzReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://www.ehkd.topReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://www.giyztm.xyzexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://www.msn.com/en-uexplorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://www.giyztm.xyz/ge07/www.epehr.picsexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://www.f7y2i9fgm.xyzReferer:explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAHG-darkexplorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://www.ostcanadantpl.topexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://www.g18q11a.topexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://www.acifictechnologycctv.netexplorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      http://www.reyhazeusa.shop/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsmexplorer.exe, 00000004.00000002.2382491394.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1325301295.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2394648634.0000000007AF2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.3753814442.0000000007ADA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://www.ngeribe2.homes/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        http://www.dvle-father.xyz/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        http://www.epehr.pics/ge07/explorer.exe, 00000004.00000003.2272196509.000000000C506000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.2403553676.000000000C54C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.2274659341.000000000C54B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        http://schemas.microsoft.explorer.exe, 0000000E.00000002.3769483542.000000000C745000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svgexplorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://powerpoint.office.comexplorer.exe, 00000004.00000002.2395472104.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1330403346.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2466769749.0000000009B26000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2467538759.0000000009B26000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://www.foreca.comexplorer.exe, 00000004.00000000.1325301295.00000000071B2000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://www.msn.com/en-us/sports/other/paul-finebaum-ranks-his-top-four-college-football-teams-this-explorer.exe, 0000000E.00000003.2384619575.0000000007AE7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2391403988.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2389058512.0000000007ADA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high

                                                                                                                  World Map of Contacted IPs

                                                                                                                  ⊘No contacted IP infos

                                                                                                                  General Information

                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                  Analysis ID:1560971
                                                                                                                  Start date and time:2024-11-22 15:11:13 +01:00
                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                  Overall analysis duration:0h 11m 12s
                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                  Report type:full
                                                                                                                  Cookbook file name:default.jbs
                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                  Number of analysed new started processes analysed:30
                                                                                                                  Number of new started drivers analysed:0
                                                                                                                  Number of existing processes analysed:0
                                                                                                                  Number of existing drivers analysed:0
                                                                                                                  Number of injected processes analysed:1
                                                                                                                  Technologies:
                                                                                                                  • HCA enabled
                                                                                                                  • EGA enabled
                                                                                                                  • AMSI enabled
                                                                                                                  Analysis Mode:default
                                                                                                                  Analysis stop reason:Timeout
                                                                                                                  Sample name:NEW ORDER_.exe
                                                                                                                  Detection:MAL
                                                                                                                  Classification:mal100.troj.evad.winEXE@301/8@6/0
                                                                                                                  EGA Information:
                                                                                                                  • Successful, ratio: 100%
                                                                                                                  HCA Information:
                                                                                                                  • Successful, ratio: 100%
                                                                                                                  • Number of executed functions: 60
                                                                                                                  • Number of non-executed functions: 290
                                                                                                                  Cookbook Comments:
                                                                                                                  • Found application associated with file extension: .exe
                                                                                                                  • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                  Warnings

                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, backgroundTaskHost.exe, SearchApp.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe, StartMenuExperienceHost.exe, TextInputHost.exe, mobsync.exe
                                                                                                                  • Excluded IPs from analysis (whitelisted): 204.79.197.203
                                                                                                                  • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, r.bing.com, a-0003.a-msedge.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, api-msn-com.a-0003.a-msedge.net
                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                  • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                  • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                  • Report size getting too big, too many NtEnumerateValueKey calls found.
                                                                                                                  • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                  • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                  • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                  • VT rate limit hit for: NEW ORDER_.exe

                                                                                                                  Simulations

                                                                                                                  Behavior and APIs

                                                                                                                  TimeTypeDescription
                                                                                                                  09:12:31API Interceptor990241x Sleep call for process: explorer.exe modified
                                                                                                                  10:15:42API Interceptor7424401x Sleep call for process: ipconfig.exe modified

                                                                                                                  Joe Sandbox View / Context

                                                                                                                  IPs

                                                                                                                  ⊘No context

                                                                                                                  Domains

                                                                                                                  ⊘No context

                                                                                                                  ASNs

                                                                                                                  ⊘No context

                                                                                                                  JA3 Fingerprints

                                                                                                                  ⊘No context

                                                                                                                  Dropped Files

                                                                                                                  ⊘No context

                                                                                                                  Created / dropped Files

                                                                                                                  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_fe8167436d6db6c6d2c4bed5d6f2d2c06e142845_f78a65ed_d88794a9-3ae8-4ccf-9e81-c2d383b4609a\Report.wer

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\System32\WerFault.exe
                                                                                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):65536
                                                                                                                  Entropy (8bit):2.2808783195100086
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:384:LnBWCmLsxVwjw6gk3RCR0CPezuiFXY4lO8k:LnBWvsxVwj0khw0QezuiFXY4lO8
                                                                                                                  MD5:8A42E30EE488BFD51D5EFB7257EC3063
                                                                                                                  SHA1:2944F0F0225DBA76325116F8EBE5E5B00F84BDF3
                                                                                                                  SHA-256:83E7780C932FBFBB00F4809891107C37A143226A26A7B488B15BA3E2093D56EB
                                                                                                                  SHA-512:3ADF05A6E79149D005DE32E36586588218399E817065FA28C7D5521CB26098E87CB5DBDA1F64AE25F784FFD230BE384639FB8FDFAE907125589CD6A3ABAA364A
                                                                                                                  Malicious:false
                                                                                                                  Reputation:low
                                                                                                                  Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.7.6.2.2.0.3.6.1.8.6.4.0.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.F.l.a.g.s.=.5.2.4.2.8.8.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.8.8.7.9.4.a.9.-.3.a.e.8.-.4.c.c.f.-.9.e.8.1.-.c.2.d.3.8.3.b.4.6.0.9.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.8.8.4.0.1.3.6.-.9.9.0.4.-.4.f.9.c.-.a.6.9.9.-.3.a.4.e.6.1.7.9.8.0.e.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.E.x.p.l.o.r.e.r...E.X.E.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.X.P.L.O.R.E.R...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.d.8.-.0.0.0.1.-.0.0.1.4.-.5.d.5.5.-.5.1.7.5.d.f.3.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.9.0.b.0.8.0.e.0.6.5.5.7.2.0.c.a.d.8.c.1.c.a.e.4.b.8.1.9.3.c.9.3.8.2.c.9.a.c.9.2.!.e.x.p.l.o.r.e.r...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.0.2././.1.2././.2.1.:.2.0.:.5.

                                                                                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WER1593.tmp.WERInternalMetadata.xml

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\System32\WerFault.exe
                                                                                                                  File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):10850
                                                                                                                  Entropy (8bit):3.7017869834833723
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:192:R6l7wVeJdzcR6YsSigmfqzV3pra89bExttQOcoPdfWsm:R6lXJpcR6YJigmfqzVZE7tQOcoPdf0
                                                                                                                  MD5:A3981641DBE041E7E4D62CA30E6B9281
                                                                                                                  SHA1:A435FF05AE45B46965C9B86184F7EBF542A1E49F
                                                                                                                  SHA-256:6CA50CD2CCDE0078F9127BAB591AA9478E8C41EB329880F519D8E8226936FC10
                                                                                                                  SHA-512:D4C3FEAEEFD83C3091A580579976625008C62F24F970BEECE9EA6B3EF5C392542C533F33017ABAD025D287B7124D8D9A9198C56A83639A51B505219F4E74173F
                                                                                                                  Malicious:false
                                                                                                                  Reputation:low
                                                                                                                  Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.5.6.<./.P.i.

                                                                                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WER15C3.tmp.xml

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\System32\WerFault.exe
                                                                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):4724
                                                                                                                  Entropy (8bit):4.465247787762757
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:48:cvIwWl8zsbJg771I9GhWpW8VYnPYm8M4JYmFZyq85c4Gb9Q32d:uIjf1I7Bw7VrJRdba32d
                                                                                                                  MD5:42214C0B8297ADAD3C90DE330BD1A935
                                                                                                                  SHA1:BCCF2585A92BBC63B31EC84DA920F434A6A9E44B
                                                                                                                  SHA-256:F748FFE6FDA6B112C9DDF057F2E4428A066299D1048C53045DEC2F159F84A462
                                                                                                                  SHA-512:D2E13D04419B498E782AB4A3FEB12A2731E2603F984D3C26730C51E0B0CE7AB98A89C63E6968EA6372410370C80098F68B8BF3BD4EE5BE45014ADEA0A902AD82
                                                                                                                  Malicious:false
                                                                                                                  Reputation:low
                                                                                                                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="599419" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                  C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD8.tmp.dmp

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\System32\WerFault.exe
                                                                                                                  File Type:Mini DuMP crash report, 17 streams, Fri Nov 22 15:16:45 2024, 0x1205a4 type
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):1059072
                                                                                                                  Entropy (8bit):1.3630316515466103
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:f6+NxLjAVHUlG4oJTFit3LLLDUpCm9e/oYQeF:f7Nx4HeG4oJTFihLLCt9w
                                                                                                                  MD5:C949AC86F8821C22C1916A951B8B17C9
                                                                                                                  SHA1:E26A20F2642CA87F917BFBC4B1F88951B0D87517
                                                                                                                  SHA-256:981806EA67E0FFBBAC417EBD4E14ADDF378C7D3890D03B19D7081F12EDA21E6F
                                                                                                                  SHA-512:09209A05FD3D9097B538EE0065E79AA7D4ABA6BAC8E8D0A6E073317D5D4905D07C5C80E78E8AF88C9A5327EC187DFB22C283EDFB32ACE4C4CF23B771DF79BFD8
                                                                                                                  Malicious:false
                                                                                                                  Preview:MDMP..a..... .......].@g................ ........l..........|...........................D...........x.......8...........T...$........P..8...........T...........@..........................................................................................eJ.............Lw......................T.............@g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...............................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001b.db

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\explorer.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):107552
                                                                                                                  Entropy (8bit):4.006121047677462
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:768:Vql6ICkbGY6SxCjk0ooMvqjUNtLNwzjU1ONPJZ4R1v4AQzKlJmKypu3UOhwiAGig:VECkH6XMvqjhKJhwiAGinnEFJKVn1Tob
                                                                                                                  MD5:12BBD33398F9523058AA3E7E4CC26D27
                                                                                                                  SHA1:77460402F235B36394CBC36FDCD0F129727FB285
                                                                                                                  SHA-256:F59C7DE0D90FCA509541F3166D5AFCC7987CA98C44CFC758908A452716F7AAF9
                                                                                                                  SHA-512:0AFABEA51E8EC7AFBAA32E4809791C73AAFF91C1AF85AF2BB93E796A70348D7874E9498EA622E57DE00FE6CCBE0DBD098A49C48A13C224B797B1CBB338EE438E
                                                                                                                  Malicious:false
                                                                                                                  Preview:....h... ... ..........P..............X...H...].......................V.......e.n.-.C.H.;.e.n.-.G.B....... ......................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D............................................f.r.o.n.t.d.e.s.k.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................0..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D.................................

                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Windows[1].json

                                                                                                                  Download File
                                                                                                                  Process:C:\Windows\explorer.exe
                                                                                                                  File Type:JSON data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):857
                                                                                                                  Entropy (8bit):5.194883672748865
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:24:Yzc2vLHYbiIdykC3c20CfHt0drc6hE10g:YzDzOyzDZPt0drcAESg
                                                                                                                  MD5:400A59E4BA3837A388D7579FCEFC0FF3
                                                                                                                  SHA1:BDD02FBE7512365224245A4B4BE1FE1C3DB41279
                                                                                                                  SHA-256:A298CF2BCF1EC4E2BC2254448AB1121C5BCABC6C00194B24F71065BFC821A9E9
                                                                                                                  SHA-512:51E5E90E9481B26B8D227311F00BF20179B60FEA7567980262254F75E0A1F00C59775E2861611E259E797FC81A6FBFC26104B0C074988A19571F561650C17DCA
                                                                                                                  Malicious:false
                                                                                                                  Preview:{"serviceContext":{"serviceActivityId":"3fc00227-56f4-4b79-8bf9-3f2df138ce2e","responseCreationDateTime":"0001-01-01T00:00:00","debugId":"3fc00227-56f4-4b79-8bf9-3f2df138ce2e|2024-11-22T14:14:09.7077489Z|fabric_msn|NEU-A|News_458","tier":"\u0000","clientActivityId":"5956814F-3FAD-4C01-9872-EA5832A95802"},"expirationDateTime":"0001-01-01T00:00:00","showBadge":false,"settings":{"refreshIntervalMinutes":0,"feedEnabled":true,"evolvedNotificationLifecycleEnabled":false,"showBadgeOnRotationsForEvolvedNotificationLifecycle":false,"webView2Enabled":false,"webView2EnabledV1":false,"windowsSuppressClientRace":false,"flyoutV2EndpointEnabled":false,"showAnimation":false,"useTallerFlyoutSize":false,"useDynamicHeight":false,"useWiderFlyoutSize":false,"reclaimEnabled":false,"isPreviewDurationsEnabled":false,"1SlockscreenContentEnabled":true},"isPartial":false}

                                                                                                                  C:\Users\user\AppData\Local\Temp\aut7281.tmp

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\NEW ORDER_.exe
                                                                                                                  File Type:data
                                                                                                                  Category:dropped
                                                                                                                  Size (bytes):185278
                                                                                                                  Entropy (8bit):7.982068325943323
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:ZoKX8I8lNMJeD9pF+tSJ8BJAIvKsvGsaupesTNNanRdUju:azI8l2JWpQSOoIvKedPpesBNc6ju
                                                                                                                  MD5:98707AA2FBD6A8DAA4CE4EFFC9C0CCFE
                                                                                                                  SHA1:76E0C9FFBD48C55BAA7FB9C83ED0949CF491C29D
                                                                                                                  SHA-256:5FD8D5B419BE7873E73615645AFB4EBFE4D08CEB8FDAEACAB89721BFBF10677F
                                                                                                                  SHA-512:6E44BC582EF37483E88F1B54326A8B1CD3F8CDCF2C4882722B32E9209BF60BB0FE6FA78B2B22F334A194F460415DCC7EC7EDDBCE3AE3D3D957CFE29DF6DB90A5
                                                                                                                  Malicious:false
                                                                                                                  Preview:EA06.......P...O..z:I.O....yTy.;k..R'.}w"..4.jT.bgQ..h4y.>mZ.R...}`.i....>&.5..1Qo..-..Y&.i].=.K.s9.JwR...S[=VU..P........-.I..S...q....v...1..:R.F..T...?..Q.p.\.s.)....O...4..&5..k.'..A|4....2._..J..q^...ko0..U..2e...[n....)..C.K...U....h....:....L)..X....p.LM)w..>.G.S...L.....D...........(... ........\..0sz-...i..j5)`.....5............._..........f.vy.J...B..8.Z.....G.:...2.....~5..\.V.D.......ye{.].^...=....O...7>.....?...kvs,.J.>..6z..a..M.x^..w...$.No.....Y.].Q.x.<B...W.0....W..g.M.>.@.J...._.(..u...F....6[~V.}G.~|...k...W.,~....7P...D..v.`...?.O..N;IQ......3>.j.......a.....qD...*V.s..Mh...;....&...*...iq.........O>.E.f&...g..<s....C....);......wi[.....h(...C'..T...........'K...(......w...=..I.v..;g_...:.3.j.n.3~l&.l.B.....B...n|s.................<..pi.....D....b.E6{.W;.{...|M?.n.tv..LEd.P.c..^\..B.n..Mgw... .n=.A..rn..|.3:.\....+Q#...[}v..G.t.S.m.s..^{<..?....$.?.Z.....t......Yev>.k.e.s6...69.W......`fv.g...s9.J.o.ml.ZF...Oy

                                                                                                                  C:\Users\user\AppData\Local\Temp\syphilous

                                                                                                                  Download File
                                                                                                                  Process:C:\Users\user\Desktop\NEW ORDER_.exe
                                                                                                                  File Type:data
                                                                                                                  Category:modified
                                                                                                                  Size (bytes):189440
                                                                                                                  Entropy (8bit):7.862810296240039
                                                                                                                  Encrypted:false
                                                                                                                  SSDEEP:3072:vJhBvqHYLJ7esPfrpTMR9GCFGTMpkcrKzW/aQle/A/HbGGykT95SN1IG3X+wnp8h:vJhBPf1w9GCF0MRrKrv/A/HHoWcX+wn+
                                                                                                                  MD5:3DCCDE816AF41CF0AB791459E2F88D74
                                                                                                                  SHA1:105936060EF404AE62FBECF9BA8A761D18386ADB
                                                                                                                  SHA-256:10D66AF3F588891A95A8D42AE962AA6453122C1EE8EFE104EEE7CBEDF46F6D32
                                                                                                                  SHA-512:B49A6AC32C6CA3949CCB3E1A77115F6084199DA52D5D852487AA70EDEC1A549E2D9ACDA842BEBE99253877529F606E1852591A9671B2F183C61934CB1BFB2A62
                                                                                                                  Malicious:false
                                                                                                                  Preview:}....0OOI..;....y.G4....H8...W0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OO.QRL<G._5.H...7..jd0&+w@= .#3!.;R?[*5gU*.(C%.1!x...o$>6).U>[.EAG7O6Z..8...1.../..T..Q....Q..Z....).0....4.`1P9..'.7O6Z6K0XOXW0OOIQ..2X.P4E..^.6Z6K0XOX.0MNBPXL2.1Q5EAG7O6ZF.1XOHW0O.KQRLrX3A5EAE7O3Z7K0XOXR0NOIQRL2.1Q5GAG7O6Z4Kp.OXG0O_IQRL"X3A5EAG7O&Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z.?U ;XW0..KQR\2X3.7EAW7O6Z6K0XOXW0OOiQR,2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL2X3Q5EAG7O6Z6K0XOXW0OOIQRL

                                                                                                                  Static File Info

                                                                                                                  General

                                                                                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                  Entropy (8bit):7.013708102383552
                                                                                                                  TrID:
                                                                                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                  • DOS Executable Generic (2002/1) 0.02%
                                                                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                  File name:NEW ORDER_.exe
                                                                                                                  File size:1'105'408 bytes
                                                                                                                  MD5:1a8ae43a449f63e9f91d429fe7b21a18
                                                                                                                  SHA1:abd2a58b8df340f0791eaaf522841e6f5484ce13
                                                                                                                  SHA256:87e77805c61d64114809ab00f0d224e261109e968300ae193c0a9024caa97807
                                                                                                                  SHA512:d8334f0ce725aa691146220bd76b9f889be379f486b844c201f600c8bc1f3baca04abbd8a36e4961f84be67f858cd3865b87ce7c817f37a894c6f6784b0d741d
                                                                                                                  SSDEEP:24576:2tb20pkaCqT5TBWgNQ7aGBaC7c+B9rxFd6A:jVg5tQ7aGBLo+Bdxb5
                                                                                                                  TLSH:4035CF1363DDC365C3B25273BA15B701AEBF782506B1F96B2FD8093DE920122525EA73
                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

                                                                                                                  File Icon

                                                                                                                  Icon Hash:aaf3e3e3938382a0

                                                                                                                  Static PE Info

                                                                                                                  General

                                                                                                                  Entrypoint:0x425f74
                                                                                                                  Entrypoint Section:.text
                                                                                                                  Digitally signed:false
                                                                                                                  Imagebase:0x400000
                                                                                                                  Subsystem:windows gui
                                                                                                                  Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                                  DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                                                  Time Stamp:0x673F1C2B [Thu Nov 21 11:40:27 2024 UTC]
                                                                                                                  TLS Callbacks:
                                                                                                                  CLR (.Net) Version:
                                                                                                                  OS Version Major:5
                                                                                                                  OS Version Minor:1
                                                                                                                  File Version Major:5
                                                                                                                  File Version Minor:1
                                                                                                                  Subsystem Version Major:5
                                                                                                                  Subsystem Version Minor:1
                                                                                                                  Import Hash:3d95adbf13bbe79dc24dccb401c12091

                                                                                                                  Entrypoint Preview

                                                                                                                  Instruction
                                                                                                                  call 00007F51C12689FFh
                                                                                                                  jmp 00007F51C125BA14h
                                                                                                                  int3
                                                                                                                  int3
                                                                                                                  push edi
                                                                                                                  push esi
                                                                                                                  mov esi, dword ptr [esp+10h]
                                                                                                                  mov ecx, dword ptr [esp+14h]
                                                                                                                  mov edi, dword ptr [esp+0Ch]
                                                                                                                  mov eax, ecx
                                                                                                                  mov edx, ecx
                                                                                                                  add eax, esi
                                                                                                                  cmp edi, esi
                                                                                                                  jbe 00007F51C125BB9Ah
                                                                                                                  cmp edi, eax
                                                                                                                  jc 00007F51C125BEFEh
                                                                                                                  bt dword ptr [004C0158h], 01h
                                                                                                                  jnc 00007F51C125BB99h
                                                                                                                  rep movsb
                                                                                                                  jmp 00007F51C125BEACh
                                                                                                                  cmp ecx, 00000080h
                                                                                                                  jc 00007F51C125BD64h
                                                                                                                  mov eax, edi
                                                                                                                  xor eax, esi
                                                                                                                  test eax, 0000000Fh
                                                                                                                  jne 00007F51C125BBA0h
                                                                                                                  bt dword ptr [004BA370h], 01h
                                                                                                                  jc 00007F51C125C070h
                                                                                                                  bt dword ptr [004C0158h], 00000000h
                                                                                                                  jnc 00007F51C125BD3Dh
                                                                                                                  test edi, 00000003h
                                                                                                                  jne 00007F51C125BD4Eh
                                                                                                                  test esi, 00000003h
                                                                                                                  jne 00007F51C125BD2Dh
                                                                                                                  bt edi, 02h
                                                                                                                  jnc 00007F51C125BB9Fh
                                                                                                                  mov eax, dword ptr [esi]
                                                                                                                  sub ecx, 04h
                                                                                                                  lea esi, dword ptr [esi+04h]
                                                                                                                  mov dword ptr [edi], eax
                                                                                                                  lea edi, dword ptr [edi+04h]
                                                                                                                  bt edi, 03h
                                                                                                                  jnc 00007F51C125BBA3h
                                                                                                                  movq xmm1, qword ptr [esi]
                                                                                                                  sub ecx, 08h
                                                                                                                  lea esi, dword ptr [esi+08h]
                                                                                                                  movq qword ptr [edi], xmm1
                                                                                                                  lea edi, dword ptr [edi+08h]
                                                                                                                  test esi, 00000007h
                                                                                                                  je 00007F51C125BBF5h
                                                                                                                  bt esi, 03h
                                                                                                                  jnc 00007F51C125BC48h
                                                                                                                  movdqa xmm1, dqword ptr [esi+00h]

                                                                                                                  Rich Headers

                                                                                                                  Programming Language:
                                                                                                                  • [ C ] VS2008 SP1 build 30729
                                                                                                                  • [IMP] VS2008 SP1 build 30729
                                                                                                                  • [ASM] VS2012 UPD4 build 61030
                                                                                                                  • [RES] VS2012 UPD4 build 61030
                                                                                                                  • [LNK] VS2012 UPD4 build 61030

                                                                                                                  Data Directories

                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0xb70040x17c.rdata
                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0xc40000x44cc0.rsrc
                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x1090000x6c4c.reloc
                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x8d8d00x1c.rdata
                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb27300x40.rdata
                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x8d0000x860.rdata
                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                  Sections

                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                  .text0x10000x8b54f0x8b600f437a6545e938612764dbb0a314376fcFalse0.5699499019058296data6.680413749210956IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                  .rdata0x8d0000x2cc420x2ce00827ffd24759e8e420890ecf164be989eFalse0.330464397632312data5.770192333189168IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                  .data0xba0000x9d540x6200e0a519f8e3a35fae0d9c2cfd5a4bacfcFalse0.16402264030612246data2.002691099965349IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                  .rsrc0xc40000x44cc00x44e003ee33d968ffe66b3dedad0ac4ca59220False0.90429333030853data7.839656319788852IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                  .reloc0x1090000xa4740xa6000bc98f8631ef0bde830a7f83bb06ff08False0.5017884036144579data5.245426654116355IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                  Resources

                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                  RT_ICON0xc45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                                                  RT_ICON0xc46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                                                  RT_ICON0xc47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                                                  RT_ICON0xc49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                                                                                  RT_ICON0xc4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                                                                                  RT_ICON0xc4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                                                                                  RT_ICON0xc5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                                                                                  RT_ICON0xc64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                                                                                  RT_ICON0xc69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                                                                                  RT_ICON0xc8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                                                                                  RT_ICON0xca0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                                                                                  RT_MENU0xca4a00x50dataEnglishGreat Britain0.9
                                                                                                                  RT_STRING0xca4f00x594dataEnglishGreat Britain0.3333333333333333
                                                                                                                  RT_STRING0xcaa840x68adataEnglishGreat Britain0.2747909199522103
                                                                                                                  RT_STRING0xcb1100x490dataEnglishGreat Britain0.3715753424657534
                                                                                                                  RT_STRING0xcb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                                                  RT_STRING0xcbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                                                                                  RT_STRING0xcc1f80x466dataEnglishGreat Britain0.3605683836589698
                                                                                                                  RT_STRING0xcc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                                                                                  RT_RCDATA0xcc7b80x3bfc5data1.0003296689879162
                                                                                                                  RT_GROUP_ICON0x1087800x76dataEnglishGreat Britain0.6610169491525424
                                                                                                                  RT_GROUP_ICON0x1087f80x14dataEnglishGreat Britain1.25
                                                                                                                  RT_GROUP_ICON0x10880c0x14dataEnglishGreat Britain1.15
                                                                                                                  RT_GROUP_ICON0x1088200x14dataEnglishGreat Britain1.25
                                                                                                                  RT_VERSION0x1088340xdcdataEnglishGreat Britain0.6181818181818182
                                                                                                                  RT_MANIFEST0x1089100x3b0ASCII text, with CRLF line terminatorsEnglishGreat Britain0.5116525423728814

                                                                                                                  Imports

                                                                                                                  DLLImport
                                                                                                                  WSOCK32.dll__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
                                                                                                                  VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                                                                                  WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                                                  COMCTL32.dllImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
                                                                                                                  MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                                                                                                  WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
                                                                                                                  PSAPI.DLLGetProcessMemoryInfo
                                                                                                                  IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                                                                                                  USERENV.dllUnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
                                                                                                                  UxTheme.dllIsThemeActive
                                                                                                                  KERNEL32.dllHeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
                                                                                                                  USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
                                                                                                                  GDI32.dllSetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
                                                                                                                  COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                                                  ADVAPI32.dllGetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
                                                                                                                  SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                                                  ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                                                                                  OLEAUT32.dllRegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

                                                                                                                  Possible Origin

                                                                                                                  Language of compilation systemCountry where language is spokenMap
                                                                                                                  EnglishGreat Britain

                                                                                                                  Network Behavior

                                                                                                                  Network Port Distribution

                                                                                                                  UDP Packets

                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                  Nov 22, 2024 15:12:50.400357008 CET6236453192.168.2.71.1.1.1
                                                                                                                  Nov 22, 2024 15:12:50.638438940 CET53623641.1.1.1192.168.2.7
                                                                                                                  Nov 22, 2024 15:13:12.414789915 CET5656753192.168.2.71.1.1.1
                                                                                                                  Nov 22, 2024 15:13:12.589879990 CET53565671.1.1.1192.168.2.7
                                                                                                                  Nov 22, 2024 15:13:31.446470976 CET5431253192.168.2.71.1.1.1
                                                                                                                  Nov 22, 2024 15:13:31.746984005 CET53543121.1.1.1192.168.2.7
                                                                                                                  Nov 22, 2024 15:13:52.910263062 CET4959853192.168.2.71.1.1.1
                                                                                                                  Nov 22, 2024 15:13:53.898591995 CET4959853192.168.2.71.1.1.1
                                                                                                                  Nov 22, 2024 15:13:54.035470963 CET53495981.1.1.1192.168.2.7
                                                                                                                  Nov 22, 2024 15:14:07.630374908 CET5874653192.168.2.71.1.1.1

                                                                                                                  DNS Queries

                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                  Nov 22, 2024 15:12:50.400357008 CET192.168.2.71.1.1.10xfcStandard query (0)www.ood-packaging-jobs-brasil.todayA (IP address)IN (0x0001)false
                                                                                                                  Nov 22, 2024 15:13:12.414789915 CET192.168.2.71.1.1.10xf4acStandard query (0)www.acifictechnologycctv.netA (IP address)IN (0x0001)false
                                                                                                                  Nov 22, 2024 15:13:31.446470976 CET192.168.2.71.1.1.10x680bStandard query (0)www.reyhazeusa.shopA (IP address)IN (0x0001)false
                                                                                                                  Nov 22, 2024 15:13:52.910263062 CET192.168.2.71.1.1.10xa944Standard query (0)www.ostcanadantpl.topA (IP address)IN (0x0001)false
                                                                                                                  Nov 22, 2024 15:13:53.898591995 CET192.168.2.71.1.1.10xa944Standard query (0)www.ostcanadantpl.topA (IP address)IN (0x0001)false
                                                                                                                  Nov 22, 2024 15:14:07.630374908 CET192.168.2.71.1.1.10xc93dStandard query (0)api.msn.comA (IP address)IN (0x0001)false

                                                                                                                  DNS Answers

                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                  Nov 22, 2024 15:12:50.638438940 CET1.1.1.1192.168.2.70xfcName error (3)www.ood-packaging-jobs-brasil.todaynonenoneA (IP address)IN (0x0001)false
                                                                                                                  Nov 22, 2024 15:13:12.589879990 CET1.1.1.1192.168.2.70xf4acName error (3)www.acifictechnologycctv.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                  Nov 22, 2024 15:13:31.746984005 CET1.1.1.1192.168.2.70x680bName error (3)www.reyhazeusa.shopnonenoneA (IP address)IN (0x0001)false
                                                                                                                  Nov 22, 2024 15:13:54.035470963 CET1.1.1.1192.168.2.70xa944Name error (3)www.ostcanadantpl.topnonenoneA (IP address)IN (0x0001)false
                                                                                                                  Nov 22, 2024 15:14:07.767359972 CET1.1.1.1192.168.2.70xc93dNo error (0)api.msn.comapi-msn-com.a-0003.a-msedge.netCNAME (Canonical name)IN (0x0001)false

                                                                                                                  Statistics

                                                                                                                  CPU Usage

                                                                                                                  Click to jump to process

                                                                                                                  Memory Usage

                                                                                                                  Click to jump to process

                                                                                                                  High Level Behavior Distribution

                                                                                                                  Click to dive into process behavior distribution

                                                                                                                  Behavior

                                                                                                                  Click to jump to process

                                                                                                                  System Behavior

                                                                                                                  General

                                                                                                                  Target ID:0
                                                                                                                  Start time:09:12:12
                                                                                                                  Start date:22/11/2024
                                                                                                                  Path:C:\Users\user\Desktop\NEW ORDER_.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Users\user\Desktop\NEW ORDER_.exe"
                                                                                                                  Imagebase:0x6f0000
                                                                                                                  File size:1'105'408 bytes
                                                                                                                  MD5 hash:1A8AE43A449F63E9F91D429FE7B21A18
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Yara matches:
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.1320406705.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  Reputation:low
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:2
                                                                                                                  Start time:09:12:13
                                                                                                                  Start date:22/11/2024
                                                                                                                  Path:C:\Windows\SysWOW64\svchost.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Users\user\Desktop\NEW ORDER_.exe"
                                                                                                                  Imagebase:0x10000
                                                                                                                  File size:46'504 bytes
                                                                                                                  MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                                                                  Has elevated privileges:true
                                                                                                                  Has administrator privileges:true
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Yara matches:
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.1374290968.0000000003170000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.1373841275.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.1374329870.00000000031A0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:4
                                                                                                                  Start time:09:12:14
                                                                                                                  Start date:22/11/2024
                                                                                                                  Path:C:\Windows\explorer.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\Explorer.EXE
                                                                                                                  Imagebase:0x7ff70ffd0000
                                                                                                                  File size:5'141'208 bytes
                                                                                                                  MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Yara matches:
                                                                                                                  • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000004.00000002.2404261388.000000000E470000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:5
                                                                                                                  Start time:09:12:17
                                                                                                                  Start date:22/11/2024
                                                                                                                  Path:C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:"C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                  Imagebase:0xed0000
                                                                                                                  File size:29'184 bytes
                                                                                                                  MD5 hash:3A3B9A5E00EF6A3F83BF300E2B6B67BB
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Yara matches:
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.3748101037.0000000000C90000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.3749816830.0000000003140000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.3749960996.0000000003170000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                  Reputation:moderate
                                                                                                                  Has exited:false

                                                                                                                  General

                                                                                                                  Target ID:6
                                                                                                                  Start time:09:12:20
                                                                                                                  Start date:22/11/2024
                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                  Wow64 process (32bit):true
                                                                                                                  Commandline:/c del "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                  Imagebase:0x410000
                                                                                                                  File size:236'544 bytes
                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:7
                                                                                                                  Start time:09:12:20
                                                                                                                  Start date:22/11/2024
                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  Imagebase:0x7ff75da10000
                                                                                                                  File size:862'208 bytes
                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:13
                                                                                                                  Start time:10:16:43
                                                                                                                  Start date:22/11/2024
                                                                                                                  Path:C:\Windows\System32\WerFault.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:C:\Windows\system32\WerFault.exe -u -p 4056 -s 3536
                                                                                                                  Imagebase:0x7ff648f10000
                                                                                                                  File size:570'736 bytes
                                                                                                                  MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:true

                                                                                                                  General

                                                                                                                  Target ID:14
                                                                                                                  Start time:10:16:46
                                                                                                                  Start date:22/11/2024
                                                                                                                  Path:C:\Windows\explorer.exe
                                                                                                                  Wow64 process (32bit):false
                                                                                                                  Commandline:explorer.exe
                                                                                                                  Imagebase:0x7ff70ffd0000
                                                                                                                  File size:5'141'208 bytes
                                                                                                                  MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                  Has elevated privileges:false
                                                                                                                  Has administrator privileges:false
                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                  Reputation:high
                                                                                                                  Has exited:false

                                                                                                                  Disassembly

                                                                                                                  Reset < >

                                                                                                                    Execution Graph

                                                                                                                    Execution Coverage:4.3%
                                                                                                                    Dynamic/Decrypted Code Coverage:0.4%
                                                                                                                    Signature Coverage:6.9%
                                                                                                                    Total number of Nodes:2000
                                                                                                                    Total number of Limit Nodes:36
                                                                                                                    execution_graph 92925 7619dd 92930 6f4a30 92925->92930 92927 7619f1 92950 710f0a 52 API calls __cinit 92927->92950 92929 7619fb 92931 6f4a40 __ftell_nolock 92930->92931 92951 6fd7f7 92931->92951 92935 6f4aff 92963 6f363c 92935->92963 92942 6fd7f7 48 API calls 92943 6f4b32 92942->92943 92985 6f49fb 92943->92985 92945 6f61a6 48 API calls 92949 6f4b3d _wcscat Mailbox __wsetenvp 92945->92949 92946 6f4b43 Mailbox 92946->92927 92948 6f64cf 48 API calls 92948->92949 92949->92945 92949->92946 92949->92948 92999 6fce19 92949->92999 92950->92929 93005 70f4ea 92951->93005 92953 6fd818 92954 70f4ea 48 API calls 92953->92954 92955 6f4af6 92954->92955 92956 6f5374 92955->92956 93036 71f8a0 92956->93036 92959 6fce19 48 API calls 92960 6f53a7 92959->92960 93038 6f660f 92960->93038 92962 6f53b1 Mailbox 92962->92935 92964 6f3649 __ftell_nolock 92963->92964 93085 6f366c GetFullPathNameW 92964->93085 92966 6f365a 92967 6f6a63 48 API calls 92966->92967 92968 6f3669 92967->92968 92969 6f518c 92968->92969 92970 6f5197 92969->92970 92971 6f519f 92970->92971 92972 761ace 92970->92972 93087 6f5130 92971->93087 92973 6f6b4a 48 API calls 92972->92973 92976 761adb __wsetenvp 92973->92976 92975 6f4b18 92979 6f64cf 92975->92979 92977 70ee75 48 API calls 92976->92977 92978 761b07 ___crtGetEnvironmentStringsW 92977->92978 92980 6f651b 92979->92980 92984 6f64dd ___crtGetEnvironmentStringsW 92979->92984 92982 70f4ea 48 API calls 92980->92982 92981 70f4ea 48 API calls 92983 6f4b29 92981->92983 92982->92984 92983->92942 92984->92981 93102 6fbcce 92985->93102 92988 6f4a2b 92988->92949 92989 7641cc RegQueryValueExW 92990 764246 RegCloseKey 92989->92990 92991 7641e5 92989->92991 92992 70f4ea 48 API calls 92991->92992 92993 7641fe 92992->92993 93108 6f47b7 92993->93108 92996 764224 92997 6f6a63 48 API calls 92996->92997 92998 76423b 92997->92998 92998->92990 93000 6fce28 __wsetenvp 92999->93000 93001 70ee75 48 API calls 93000->93001 93002 6fce50 ___crtGetEnvironmentStringsW 93001->93002 93003 70f4ea 48 API calls 93002->93003 93004 6fce66 93003->93004 93004->92949 93007 70f4f2 __calloc_impl 93005->93007 93008 70f50c 93007->93008 93009 70f50e std::exception::exception 93007->93009 93014 71395c 93007->93014 93008->92953 93028 716805 RaiseException 93009->93028 93011 70f538 93029 71673b 47 API calls _free 93011->93029 93013 70f54a 93013->92953 93015 7139d7 __calloc_impl 93014->93015 93021 713968 __calloc_impl 93014->93021 93035 717c0e 47 API calls __getptd_noexit 93015->93035 93018 71399b RtlAllocateHeap 93018->93021 93027 7139cf 93018->93027 93020 7139c3 93033 717c0e 47 API calls __getptd_noexit 93020->93033 93021->93018 93021->93020 93024 7139c1 93021->93024 93025 713973 93021->93025 93034 717c0e 47 API calls __getptd_noexit 93024->93034 93025->93021 93030 7181c2 47 API calls 2 library calls 93025->93030 93031 71821f 47 API calls 8 library calls 93025->93031 93032 711145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 93025->93032 93027->93007 93028->93011 93029->93013 93030->93025 93031->93025 93033->93024 93034->93027 93035->93027 93037 6f5381 GetModuleFileNameW 93036->93037 93037->92959 93039 71f8a0 __ftell_nolock 93038->93039 93040 6f661c GetFullPathNameW 93039->93040 93045 6f6a63 93040->93045 93042 6f6643 93056 6f6571 93042->93056 93046 6f6adf 93045->93046 93049 6f6a6f __wsetenvp 93045->93049 93073 6fb18b 93046->93073 93048 6f6ab6 ___crtGetEnvironmentStringsW 93048->93042 93050 6f6a8b 93049->93050 93051 6f6ad7 93049->93051 93060 6f6b4a 93050->93060 93072 6fc369 48 API calls 93051->93072 93054 6f6a95 93063 70ee75 93054->93063 93057 6f657f 93056->93057 93058 6fb18b 48 API calls 93057->93058 93059 6f658f 93058->93059 93059->92962 93061 70f4ea 48 API calls 93060->93061 93062 6f6b54 93061->93062 93062->93054 93065 70f4ea __calloc_impl 93063->93065 93064 71395c _W_store_winword 47 API calls 93064->93065 93065->93064 93066 70f50c 93065->93066 93067 70f50e std::exception::exception 93065->93067 93066->93048 93077 716805 RaiseException 93067->93077 93069 70f538 93078 71673b 47 API calls _free 93069->93078 93071 70f54a 93071->93048 93072->93048 93074 6fb1a2 ___crtGetEnvironmentStringsW 93073->93074 93075 6fb199 93073->93075 93074->93048 93075->93074 93079 6fbdfa 93075->93079 93077->93069 93078->93071 93080 6fbe0d 93079->93080 93084 6fbe0a ___crtGetEnvironmentStringsW 93079->93084 93081 70f4ea 48 API calls 93080->93081 93082 6fbe17 93081->93082 93083 70ee75 48 API calls 93082->93083 93083->93084 93084->93074 93086 6f368a 93085->93086 93086->92966 93088 6f513f __wsetenvp 93087->93088 93089 761b27 93088->93089 93090 6f5151 93088->93090 93092 6f6b4a 48 API calls 93089->93092 93097 6fbb85 93090->93097 93094 761b34 93092->93094 93093 6f515e ___crtGetEnvironmentStringsW 93093->92975 93095 70ee75 48 API calls 93094->93095 93096 761b57 ___crtGetEnvironmentStringsW 93095->93096 93098 6fbb9b 93097->93098 93100 6fbb96 ___crtGetEnvironmentStringsW 93097->93100 93099 70ee75 48 API calls 93098->93099 93101 761b77 93098->93101 93099->93100 93100->93093 93101->93101 93103 6fbce8 93102->93103 93107 6f4a0a RegOpenKeyExW 93102->93107 93104 70f4ea 48 API calls 93103->93104 93105 6fbcf2 93104->93105 93106 70ee75 48 API calls 93105->93106 93106->93107 93107->92988 93107->92989 93109 70f4ea 48 API calls 93108->93109 93110 6f47c9 RegQueryValueExW 93109->93110 93110->92996 93110->92998 93111 715dfd 93112 715e09 _doexit 93111->93112 93148 717eeb GetStartupInfoW 93112->93148 93115 715e0e 93150 719ca7 GetProcessHeap 93115->93150 93116 715e66 93117 715e71 93116->93117 93235 715f4d 47 API calls 3 library calls 93116->93235 93151 717b47 93117->93151 93120 715e77 93122 715e82 __RTC_Initialize 93120->93122 93236 715f4d 47 API calls 3 library calls 93120->93236 93172 71acb3 93122->93172 93124 715e91 93125 715e9d GetCommandLineW 93124->93125 93237 715f4d 47 API calls 3 library calls 93124->93237 93191 722e7d GetEnvironmentStringsW 93125->93191 93128 715e9c 93128->93125 93132 715ec2 93204 722cb4 93132->93204 93135 715ec8 93136 715ed3 93135->93136 93239 71115b 47 API calls 3 library calls 93135->93239 93218 711195 93136->93218 93139 715edb 93140 715ee6 __wwincmdln 93139->93140 93240 71115b 47 API calls 3 library calls 93139->93240 93222 6f3a0f 93140->93222 93143 715efa 93144 715f09 93143->93144 93241 7113f1 47 API calls _doexit 93143->93241 93242 711186 47 API calls _doexit 93144->93242 93147 715f0e _doexit 93149 717f01 93148->93149 93149->93115 93150->93116 93243 71123a 93151->93243 93153 717b4c 93246 717e23 93153->93246 93156 717b55 93259 717bbd 50 API calls 2 library calls 93156->93259 93159 717b5a 93159->93120 93161 717b72 93253 716986 93161->93253 93163 717bb4 93262 717bbd 50 API calls 2 library calls 93163->93262 93167 717b93 93167->93163 93169 717b99 93167->93169 93168 717bb9 93168->93120 93261 717a94 47 API calls 4 library calls 93169->93261 93171 717ba1 GetCurrentThreadId 93171->93120 93173 71acbf _doexit 93172->93173 93271 717cf4 93173->93271 93175 71acc6 93176 716986 __calloc_crt 47 API calls 93175->93176 93177 71acd7 93176->93177 93178 71ad42 GetStartupInfoW 93177->93178 93179 71ace2 _doexit @_EH4_CallFilterFunc@8 93177->93179 93182 71ae80 93178->93182 93184 71ad57 93178->93184 93179->93124 93180 71af44 93278 71af58 LeaveCriticalSection _doexit 93180->93278 93182->93180 93183 71aec9 GetStdHandle 93182->93183 93186 71aedb GetFileType 93182->93186 93188 71af08 InitializeCriticalSectionAndSpinCount 93182->93188 93183->93182 93184->93182 93185 716986 __calloc_crt 47 API calls 93184->93185 93187 71ada5 93184->93187 93185->93184 93186->93182 93187->93182 93189 71ade5 InitializeCriticalSectionAndSpinCount 93187->93189 93190 71add7 GetFileType 93187->93190 93188->93182 93189->93187 93190->93187 93190->93189 93192 715ead 93191->93192 93193 722e8e 93191->93193 93198 722a7b GetModuleFileNameW 93192->93198 93317 7169d0 47 API calls _W_store_winword 93193->93317 93196 722eca FreeEnvironmentStringsW 93196->93192 93197 722eb4 ___crtGetEnvironmentStringsW 93197->93196 93199 722aaf _wparse_cmdline 93198->93199 93200 715eb7 93199->93200 93201 722ae9 93199->93201 93200->93132 93238 71115b 47 API calls 3 library calls 93200->93238 93318 7169d0 47 API calls _W_store_winword 93201->93318 93203 722aef _wparse_cmdline 93203->93200 93205 722ccd __wsetenvp 93204->93205 93206 722cc5 93204->93206 93207 716986 __calloc_crt 47 API calls 93205->93207 93206->93135 93208 722cf6 __wsetenvp 93207->93208 93208->93206 93210 722d4d 93208->93210 93211 716986 __calloc_crt 47 API calls 93208->93211 93212 722d72 93208->93212 93215 722d89 93208->93215 93319 722567 47 API calls __ftell_nolock 93208->93319 93209 711c9d _free 47 API calls 93209->93206 93210->93209 93211->93208 93213 711c9d _free 47 API calls 93212->93213 93213->93206 93320 716e20 IsProcessorFeaturePresent 93215->93320 93219 7111a1 __initterm_e __initp_misc_cfltcvt_tab __IsNonwritableInCurrentImage 93218->93219 93221 7111e0 __IsNonwritableInCurrentImage 93219->93221 93343 710f0a 52 API calls __cinit 93219->93343 93221->93139 93223 6f3a29 93222->93223 93224 761ebf 93222->93224 93225 6f3a63 IsThemeActive 93223->93225 93344 711405 93225->93344 93229 6f3a8f 93356 6f3adb SystemParametersInfoW SystemParametersInfoW 93229->93356 93231 6f3a9b 93357 6f3d19 93231->93357 93233 6f3aa3 SystemParametersInfoW 93234 6f3ac8 93233->93234 93234->93143 93235->93117 93236->93122 93237->93128 93241->93144 93242->93147 93244 711243 __init_pointers __initp_misc_winsig 93243->93244 93245 717f4a 30 API calls 93244->93245 93245->93153 93247 717e2f 93246->93247 93248 717e35 InitializeCriticalSectionAndSpinCount 93247->93248 93249 717b51 93247->93249 93248->93247 93249->93156 93250 717e6d 93249->93250 93251 717e84 TlsAlloc 93250->93251 93252 717b67 93250->93252 93252->93156 93252->93161 93255 71698d 93253->93255 93256 7169ca 93255->93256 93257 7169ab Sleep 93255->93257 93263 7230aa 93255->93263 93256->93163 93260 717ec9 TlsSetValue 93256->93260 93258 7169c2 93257->93258 93258->93255 93258->93256 93259->93159 93260->93167 93261->93171 93262->93168 93264 7230b5 93263->93264 93268 7230d0 __calloc_impl 93263->93268 93265 7230c1 93264->93265 93264->93268 93270 717c0e 47 API calls __getptd_noexit 93265->93270 93267 7230e0 RtlAllocateHeap 93267->93268 93269 7230c6 93267->93269 93268->93267 93268->93269 93269->93255 93270->93269 93272 717d05 93271->93272 93273 717d18 EnterCriticalSection 93271->93273 93279 717d7c 93272->93279 93273->93175 93275 717d0b 93275->93273 93303 71115b 47 API calls 3 library calls 93275->93303 93278->93179 93280 717d88 _doexit 93279->93280 93281 717d91 93280->93281 93282 717da9 93280->93282 93304 7181c2 47 API calls 2 library calls 93281->93304 93286 717e11 _doexit 93282->93286 93295 717da7 93282->93295 93285 717d96 93305 71821f 47 API calls 8 library calls 93285->93305 93286->93275 93287 717dbd 93290 717dd3 93287->93290 93291 717dc4 93287->93291 93289 717d9d 93306 711145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 93289->93306 93294 717cf4 __lock 46 API calls 93290->93294 93308 717c0e 47 API calls __getptd_noexit 93291->93308 93297 717dda 93294->93297 93295->93282 93307 7169d0 47 API calls _W_store_winword 93295->93307 93296 717dc9 93296->93286 93298 717de9 InitializeCriticalSectionAndSpinCount 93297->93298 93299 717dfe 93297->93299 93300 717e04 93298->93300 93309 711c9d 93299->93309 93315 717e1a LeaveCriticalSection _doexit 93300->93315 93304->93285 93305->93289 93307->93287 93308->93296 93310 711ca6 RtlFreeHeap 93309->93310 93314 711ccf _free 93309->93314 93311 711cbb 93310->93311 93310->93314 93316 717c0e 47 API calls __getptd_noexit 93311->93316 93313 711cc1 GetLastError 93313->93314 93314->93300 93315->93286 93316->93313 93317->93197 93318->93203 93319->93208 93321 716e2b 93320->93321 93326 716cb5 93321->93326 93325 716e46 93325->93135 93327 716ccf _memset ___raise_securityfailure 93326->93327 93328 716cef IsDebuggerPresent 93327->93328 93334 7181ac SetUnhandledExceptionFilter UnhandledExceptionFilter 93328->93334 93330 716db3 ___raise_securityfailure 93335 71a70c 93330->93335 93332 716dd6 93333 718197 GetCurrentProcess TerminateProcess 93332->93333 93333->93325 93334->93330 93336 71a714 93335->93336 93337 71a716 IsProcessorFeaturePresent 93335->93337 93336->93332 93339 7237b0 93337->93339 93342 72375f 5 API calls 2 library calls 93339->93342 93341 723893 93341->93332 93342->93341 93343->93221 93345 717cf4 __lock 47 API calls 93344->93345 93346 711410 93345->93346 93409 717e58 LeaveCriticalSection 93346->93409 93348 6f3a88 93349 71146d 93348->93349 93350 711491 93349->93350 93351 711477 93349->93351 93350->93229 93351->93350 93410 717c0e 47 API calls __getptd_noexit 93351->93410 93353 711481 93411 716e10 8 API calls __ftell_nolock 93353->93411 93355 71148c 93355->93229 93356->93231 93358 6f3d26 __ftell_nolock 93357->93358 93359 6fd7f7 48 API calls 93358->93359 93360 6f3d31 GetCurrentDirectoryW 93359->93360 93412 6f61ca 93360->93412 93362 6f3d57 IsDebuggerPresent 93363 761cc1 MessageBoxA 93362->93363 93364 6f3d65 93362->93364 93366 761cd9 93363->93366 93364->93366 93367 6f3d82 93364->93367 93396 6f3e3a 93364->93396 93365 6f3e41 SetCurrentDirectoryW 93368 6f3e4e Mailbox 93365->93368 93598 70c682 48 API calls 93366->93598 93486 6f40e5 93367->93486 93368->93233 93371 761ce9 93376 761cff SetCurrentDirectoryW 93371->93376 93373 6f3da0 GetFullPathNameW 93374 6f6a63 48 API calls 93373->93374 93375 6f3ddb 93374->93375 93502 6f6430 93375->93502 93376->93368 93379 6f3df6 93380 6f3e00 93379->93380 93599 7371fa AllocateAndInitializeSid CheckTokenMembership FreeSid 93379->93599 93518 6f3e6e GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 93380->93518 93383 761d1c 93383->93380 93386 761d2d 93383->93386 93388 6f5374 50 API calls 93386->93388 93387 6f3e0a 93389 6f3e1f 93387->93389 93526 6f4ffc 93387->93526 93390 761d35 93388->93390 93536 6fe8d0 93389->93536 93393 6fce19 48 API calls 93390->93393 93395 761d42 93393->93395 93398 761d6e 93395->93398 93399 761d49 93395->93399 93396->93365 93400 6f518c 48 API calls 93398->93400 93401 6f518c 48 API calls 93399->93401 93402 761d6a GetForegroundWindow ShellExecuteW 93400->93402 93403 761d54 93401->93403 93406 761d9e Mailbox 93402->93406 93600 6f510d 93403->93600 93406->93396 93408 6f518c 48 API calls 93408->93402 93409->93348 93410->93353 93411->93355 93609 70e99b 93412->93609 93416 6f61eb 93417 6f5374 50 API calls 93416->93417 93418 6f61ff 93417->93418 93419 6fce19 48 API calls 93418->93419 93420 6f620c 93419->93420 93626 6f39db 93420->93626 93422 6f6216 Mailbox 93638 6f6eed 93422->93638 93427 6fce19 48 API calls 93428 6f6244 93427->93428 93645 6fd6e9 93428->93645 93430 6f6254 Mailbox 93431 6fce19 48 API calls 93430->93431 93432 6f627c 93431->93432 93433 6fd6e9 55 API calls 93432->93433 93434 6f628f Mailbox 93433->93434 93435 6fce19 48 API calls 93434->93435 93436 6f62a0 93435->93436 93649 6fd645 93436->93649 93438 6f62b2 Mailbox 93439 6fd7f7 48 API calls 93438->93439 93440 6f62c5 93439->93440 93659 6f63fc 93440->93659 93444 6f62df 93445 6f62e9 93444->93445 93446 761c08 93444->93446 93448 710fa7 _W_store_winword 59 API calls 93445->93448 93447 6f63fc 48 API calls 93446->93447 93449 761c1c 93447->93449 93450 6f62f4 93448->93450 93452 6f63fc 48 API calls 93449->93452 93450->93449 93451 6f62fe 93450->93451 93453 710fa7 _W_store_winword 59 API calls 93451->93453 93455 761c38 93452->93455 93454 6f6309 93453->93454 93454->93455 93456 6f6313 93454->93456 93458 6f5374 50 API calls 93455->93458 93457 710fa7 _W_store_winword 59 API calls 93456->93457 93459 6f631e 93457->93459 93460 761c5d 93458->93460 93461 6f635f 93459->93461 93463 761c86 93459->93463 93467 6f63fc 48 API calls 93459->93467 93462 6f63fc 48 API calls 93460->93462 93461->93463 93464 6f636c 93461->93464 93465 761c69 93462->93465 93468 6f6eed 48 API calls 93463->93468 93675 70c050 93464->93675 93466 6f6eed 48 API calls 93465->93466 93469 761c77 93466->93469 93470 6f6342 93467->93470 93471 761ca8 93468->93471 93473 6f63fc 48 API calls 93469->93473 93474 6f6eed 48 API calls 93470->93474 93475 6f63fc 48 API calls 93471->93475 93473->93463 93478 6f6350 93474->93478 93479 761cb5 93475->93479 93476 6f6384 93686 701b90 93476->93686 93480 6f63fc 48 API calls 93478->93480 93479->93479 93480->93461 93481 701b90 48 API calls 93483 6f6394 93481->93483 93483->93481 93484 6f63fc 48 API calls 93483->93484 93485 6f63d6 Mailbox 93483->93485 93702 6f6b68 48 API calls 93483->93702 93484->93483 93485->93362 93487 6f40f2 __ftell_nolock 93486->93487 93488 6f410b 93487->93488 93489 76370e _memset 93487->93489 93490 6f660f 49 API calls 93488->93490 93491 76372a GetOpenFileNameW 93489->93491 93492 6f4114 93490->93492 93494 763779 93491->93494 94335 6f40a7 93492->94335 93496 6f6a63 48 API calls 93494->93496 93498 76378e 93496->93498 93498->93498 93499 6f4129 94353 6f4139 93499->94353 93503 6f643d __ftell_nolock 93502->93503 94553 6f4c75 93503->94553 93505 6f6442 93517 6f3dee 93505->93517 94564 6f5928 86 API calls 93505->94564 93507 6f644f 93507->93517 94565 6f5798 88 API calls Mailbox 93507->94565 93509 6f6458 93510 6f645c GetFullPathNameW 93509->93510 93509->93517 93511 6f6a63 48 API calls 93510->93511 93512 6f6488 93511->93512 93513 6f6a63 48 API calls 93512->93513 93514 6f6495 93513->93514 93515 6f6a63 48 API calls 93514->93515 93516 765dcf _wcscat 93514->93516 93515->93517 93517->93371 93517->93379 93519 6f3ed8 93518->93519 93520 761cba 93518->93520 94618 6f4024 93519->94618 93524 6f3e05 93525 6f36b8 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 93524->93525 93525->93387 93527 6f5027 _memset 93526->93527 94623 6f4c30 93527->94623 93530 6f50ac 93532 6f50ca Shell_NotifyIconW 93530->93532 93533 763d28 Shell_NotifyIconW 93530->93533 94627 6f51af 93532->94627 93535 6f50df 93535->93389 93537 6fe8f6 93536->93537 93596 6fe906 Mailbox 93536->93596 93538 6fed52 93537->93538 93537->93596 94820 70e3cd 335 API calls 93538->94820 93540 6febc7 93541 6f3e2a 93540->93541 94821 6f2ff6 16 API calls 93540->94821 93541->93396 93597 6f3847 Shell_NotifyIconW _memset 93541->93597 93543 6fed63 93543->93541 93545 6fed70 93543->93545 93544 6fe94c PeekMessageW 93544->93596 94822 70e312 335 API calls Mailbox 93545->94822 93547 76526e Sleep 93547->93596 93548 6fed77 LockWindowUpdate DestroyWindow GetMessageW 93548->93541 93550 6feda9 93548->93550 93552 7659ef TranslateMessage DispatchMessageW GetMessageW 93550->93552 93552->93552 93554 6fed21 PeekMessageW 93554->93596 93555 6f1caa 49 API calls 93555->93596 93556 70f4ea 48 API calls 93556->93596 93557 6febf7 timeGetTime 93557->93596 93559 6f6eed 48 API calls 93559->93596 93560 765557 WaitForSingleObject 93565 765574 GetExitCodeProcess CloseHandle 93560->93565 93560->93596 93561 6fed3a TranslateMessage DispatchMessageW 93561->93554 93562 6fd7f7 48 API calls 93591 765429 Mailbox 93562->93591 93563 6f2aae 311 API calls 93563->93596 93564 76588f Sleep 93564->93591 93565->93596 93566 6fedae timeGetTime 94823 6f1caa 49 API calls 93566->94823 93568 765733 Sleep 93568->93591 93571 70dc38 timeGetTime 93571->93591 93572 765926 GetExitCodeProcess 93575 765952 CloseHandle 93572->93575 93576 76593c WaitForSingleObject 93572->93576 93574 765445 Sleep 93574->93596 93575->93591 93576->93575 93576->93596 93577 765432 Sleep 93577->93574 93578 758c4b 108 API calls 93578->93591 93579 6f2c79 107 API calls 93579->93591 93581 7659ae Sleep 93581->93596 93584 6fce19 48 API calls 93584->93591 93587 6fd6e9 55 API calls 93587->93591 93591->93562 93591->93571 93591->93572 93591->93574 93591->93577 93591->93578 93591->93579 93591->93581 93591->93584 93591->93587 93591->93596 94825 734cbe 49 API calls Mailbox 93591->94825 94826 6f1caa 49 API calls 93591->94826 94827 6f2aae 335 API calls 93591->94827 94857 74ccb2 50 API calls 93591->94857 94858 737a58 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 93591->94858 94859 736532 63 API calls 3 library calls 93591->94859 93593 73cc5c 86 API calls 93593->93596 93594 6fce19 48 API calls 93594->93596 93595 6fd6e9 55 API calls 93595->93596 93596->93540 93596->93544 93596->93547 93596->93554 93596->93555 93596->93556 93596->93557 93596->93559 93596->93560 93596->93561 93596->93563 93596->93564 93596->93566 93596->93568 93596->93574 93596->93591 93596->93593 93596->93594 93596->93595 94650 6fef00 93596->94650 94655 6ff110 93596->94655 94720 7045e0 93596->94720 94737 70e244 93596->94737 94742 70dc5f 93596->94742 94747 6feed0 335 API calls Mailbox 93596->94747 94748 703200 93596->94748 94824 758d23 48 API calls 93596->94824 94828 6ffe30 93596->94828 93597->93396 93598->93371 93599->93383 93601 6f511f 93600->93601 93602 761be7 93600->93602 95124 6fb384 93601->95124 95133 72a58f 48 API calls ___crtGetEnvironmentStringsW 93602->95133 93605 6f512b 93605->93408 93606 761bf1 93607 6f6eed 48 API calls 93606->93607 93608 761bf9 Mailbox 93607->93608 93610 6fd7f7 48 API calls 93609->93610 93611 6f61db 93610->93611 93612 6f6009 93611->93612 93613 6f6016 __ftell_nolock 93612->93613 93614 6f6a63 48 API calls 93613->93614 93619 6f617c Mailbox 93613->93619 93616 6f6048 93614->93616 93623 6f607e Mailbox 93616->93623 93703 6f61a6 93616->93703 93617 6f61a6 48 API calls 93617->93623 93618 6f614f 93618->93619 93620 6fce19 48 API calls 93618->93620 93619->93416 93622 6f6170 93620->93622 93621 6fce19 48 API calls 93621->93623 93624 6f64cf 48 API calls 93622->93624 93623->93617 93623->93618 93623->93619 93623->93621 93625 6f64cf 48 API calls 93623->93625 93624->93619 93625->93623 93706 6f41a9 93626->93706 93629 6f3a06 93629->93422 93632 762ff0 93634 711c9d _free 47 API calls 93632->93634 93635 762ffd 93634->93635 93636 6f4252 84 API calls 93635->93636 93637 763006 93636->93637 93637->93637 93639 6f6ef8 93638->93639 93640 6f622b 93638->93640 94323 6fdd47 48 API calls ___crtGetEnvironmentStringsW 93639->94323 93642 6f9048 93640->93642 93643 70f4ea 48 API calls 93642->93643 93644 6f6237 93643->93644 93644->93427 93646 6fd6f4 93645->93646 93647 6fd71b 93646->93647 94324 6fd764 55 API calls 93646->94324 93647->93430 93650 6fd654 93649->93650 93655 6fd67e 93649->93655 93651 6fd65b 93650->93651 93654 6fd6c2 93650->93654 93652 6fd666 93651->93652 93658 6fd6ab 93651->93658 94325 6fd9a0 53 API calls __cinit 93652->94325 93654->93658 94327 70dce0 53 API calls 93654->94327 93655->93438 93658->93655 94326 70dce0 53 API calls 93658->94326 93660 6f641f 93659->93660 93661 6f6406 93659->93661 93663 6f6a63 48 API calls 93660->93663 93662 6f6eed 48 API calls 93661->93662 93664 6f62d1 93662->93664 93663->93664 93665 710fa7 93664->93665 93666 710fb3 93665->93666 93667 711028 93665->93667 93674 710fd8 93666->93674 94328 717c0e 47 API calls __getptd_noexit 93666->94328 94330 71103a 59 API calls 3 library calls 93667->94330 93670 711035 93670->93444 93671 710fbf 94329 716e10 8 API calls __ftell_nolock 93671->94329 93673 710fca 93673->93444 93674->93444 93676 70c064 93675->93676 93678 70c069 Mailbox 93675->93678 94331 70c1af 48 API calls 93676->94331 93684 70c077 93678->93684 94332 70c15c 48 API calls 93678->94332 93680 70f4ea 48 API calls 93682 70c108 93680->93682 93681 70c152 93681->93476 93683 70f4ea 48 API calls 93682->93683 93685 70c113 93683->93685 93684->93680 93684->93681 93685->93476 93685->93685 93687 701cf6 93686->93687 93689 701ba2 93686->93689 93687->93483 93690 70f4ea 48 API calls 93689->93690 93701 701bae 93689->93701 93691 7649c4 93690->93691 93694 70f4ea 48 API calls 93691->93694 93692 701bb9 93693 701c5d 93692->93693 93695 70f4ea 48 API calls 93692->93695 93693->93483 93700 7649cf 93694->93700 93696 701c9f 93695->93696 93697 701cb2 93696->93697 94333 6f2925 48 API calls 93696->94333 93697->93483 93699 70f4ea 48 API calls 93699->93700 93700->93699 93700->93701 93701->93692 94334 70c15c 48 API calls 93701->94334 93702->93483 93704 6fbdfa 48 API calls 93703->93704 93705 6f61b1 93704->93705 93705->93616 93771 6f4214 93706->93771 93711 764f73 93714 6f4252 84 API calls 93711->93714 93712 6f41d4 LoadLibraryExW 93781 6f4291 93712->93781 93716 764f7a 93714->93716 93718 6f4291 3 API calls 93716->93718 93720 764f82 93718->93720 93719 6f41fb 93719->93720 93721 6f4207 93719->93721 93807 6f44ed 93720->93807 93722 6f4252 84 API calls 93721->93722 93725 6f39fe 93722->93725 93725->93629 93730 73c396 93725->93730 93727 764fa9 93815 6f4950 93727->93815 93731 6f4517 83 API calls 93730->93731 93732 73c405 93731->93732 94108 73c56d 93732->94108 93735 73c41b 93735->93632 93765 6f4252 93735->93765 93736 6f44ed 64 API calls 93737 73c432 93736->93737 93738 6f44ed 64 API calls 93737->93738 93739 73c442 93738->93739 93740 6f44ed 64 API calls 93739->93740 93741 73c45d 93740->93741 93742 6f44ed 64 API calls 93741->93742 93743 73c478 93742->93743 93744 6f4517 83 API calls 93743->93744 93745 73c48f 93744->93745 93746 71395c _W_store_winword 47 API calls 93745->93746 93747 73c496 93746->93747 93748 71395c _W_store_winword 47 API calls 93747->93748 93749 73c4a0 93748->93749 93750 6f44ed 64 API calls 93749->93750 93751 73c4b4 93750->93751 93752 73bf5a GetSystemTimeAsFileTime 93751->93752 93753 73c4c7 93752->93753 93754 73c4f1 93753->93754 93755 73c4dc 93753->93755 93757 73c4f7 93754->93757 93758 73c556 93754->93758 93756 711c9d _free 47 API calls 93755->93756 93760 73c4e2 93756->93760 94114 73b965 93757->94114 93759 711c9d _free 47 API calls 93758->93759 93759->93735 93762 711c9d _free 47 API calls 93760->93762 93762->93735 93764 711c9d _free 47 API calls 93764->93735 93766 6f425c 93765->93766 93770 6f4263 93765->93770 93767 7135e4 __fcloseall 83 API calls 93766->93767 93767->93770 93768 6f4283 FreeLibrary 93769 6f4272 93768->93769 93769->93632 93770->93768 93770->93769 93820 6f4339 93771->93820 93774 6f423c 93776 6f41bb 93774->93776 93777 6f4244 FreeLibrary 93774->93777 93778 713499 93776->93778 93777->93776 93828 7134ae 93778->93828 93780 6f41c8 93780->93711 93780->93712 93907 6f42e4 93781->93907 93784 6f42b8 93786 6f41ec 93784->93786 93787 6f42c1 FreeLibrary 93784->93787 93788 6f4380 93786->93788 93787->93786 93789 70f4ea 48 API calls 93788->93789 93790 6f4395 93789->93790 93791 6f47b7 48 API calls 93790->93791 93792 6f43a1 ___crtGetEnvironmentStringsW 93791->93792 93793 6f43dc 93792->93793 93794 6f4499 93792->93794 93795 6f44d1 93792->93795 93796 6f4950 57 API calls 93793->93796 93915 6f406b CreateStreamOnHGlobal 93794->93915 93926 73c750 93 API calls 93795->93926 93802 6f43e5 93796->93802 93799 6f44ed 64 API calls 93799->93802 93800 6f4479 93800->93719 93802->93799 93802->93800 93803 764ed7 93802->93803 93921 6f4517 93802->93921 93804 6f4517 83 API calls 93803->93804 93805 764eeb 93804->93805 93806 6f44ed 64 API calls 93805->93806 93806->93800 93808 6f44ff 93807->93808 93809 764fc0 93807->93809 93950 71381e 93808->93950 93812 73bf5a 94085 73bdb4 93812->94085 93814 73bf70 93814->93727 93816 6f495f 93815->93816 93817 765002 93815->93817 94090 713e65 93816->94090 93819 6f4967 93824 6f434b 93820->93824 93823 6f4321 LoadLibraryA GetProcAddress 93823->93774 93825 6f422f 93824->93825 93826 6f4354 LoadLibraryA 93824->93826 93825->93774 93825->93823 93826->93825 93827 6f4365 GetProcAddress 93826->93827 93827->93825 93831 7134ba _doexit 93828->93831 93829 7134cd 93876 717c0e 47 API calls __getptd_noexit 93829->93876 93831->93829 93833 7134fe 93831->93833 93832 7134d2 93877 716e10 8 API calls __ftell_nolock 93832->93877 93847 71e4c8 93833->93847 93836 713503 93837 713519 93836->93837 93838 71350c 93836->93838 93839 713543 93837->93839 93840 713523 93837->93840 93878 717c0e 47 API calls __getptd_noexit 93838->93878 93861 71e5e0 93839->93861 93879 717c0e 47 API calls __getptd_noexit 93840->93879 93844 7134dd _doexit @_EH4_CallFilterFunc@8 93844->93780 93848 71e4d4 _doexit 93847->93848 93849 717cf4 __lock 47 API calls 93848->93849 93859 71e4e2 93849->93859 93850 71e552 93881 71e5d7 93850->93881 93851 71e559 93886 7169d0 47 API calls _W_store_winword 93851->93886 93854 71e560 93854->93850 93856 71e56f InitializeCriticalSectionAndSpinCount EnterCriticalSection 93854->93856 93855 71e5cc _doexit 93855->93836 93856->93850 93857 717d7c __mtinitlocknum 47 API calls 93857->93859 93859->93850 93859->93851 93859->93857 93884 714e5b 48 API calls __lock 93859->93884 93885 714ec5 LeaveCriticalSection LeaveCriticalSection _doexit 93859->93885 93862 71e600 __wopenfile 93861->93862 93863 71e61a 93862->93863 93875 71e7d5 93862->93875 93893 71185b 59 API calls 2 library calls 93862->93893 93891 717c0e 47 API calls __getptd_noexit 93863->93891 93865 71e61f 93892 716e10 8 API calls __ftell_nolock 93865->93892 93867 71e838 93888 7263c9 93867->93888 93869 71354e 93880 713570 LeaveCriticalSection LeaveCriticalSection _fprintf 93869->93880 93871 71e7ce 93871->93875 93894 71185b 59 API calls 2 library calls 93871->93894 93873 71e7ed 93873->93875 93895 71185b 59 API calls 2 library calls 93873->93895 93875->93863 93875->93867 93876->93832 93877->93844 93878->93844 93879->93844 93880->93844 93887 717e58 LeaveCriticalSection 93881->93887 93883 71e5de 93883->93855 93884->93859 93885->93859 93886->93854 93887->93883 93896 725bb1 93888->93896 93890 7263e2 93890->93869 93891->93865 93892->93869 93893->93871 93894->93873 93895->93875 93899 725bbd _doexit 93896->93899 93897 725bcf 93898 717c0e __ftell_nolock 47 API calls 93897->93898 93900 725bd4 93898->93900 93899->93897 93901 725c06 93899->93901 93902 716e10 __ftell_nolock 8 API calls 93900->93902 93903 725c78 __wsopen_helper 110 API calls 93901->93903 93906 725bde _doexit 93902->93906 93904 725c23 93903->93904 93905 725c4c __wsopen_helper LeaveCriticalSection 93904->93905 93905->93906 93906->93890 93911 6f42f6 93907->93911 93910 6f42cc LoadLibraryA GetProcAddress 93910->93784 93912 6f42aa 93911->93912 93913 6f42ff LoadLibraryA 93911->93913 93912->93784 93912->93910 93913->93912 93914 6f4310 GetProcAddress 93913->93914 93914->93912 93916 6f4085 FindResourceExW 93915->93916 93917 6f40a2 93915->93917 93916->93917 93918 764f16 LoadResource 93916->93918 93917->93793 93918->93917 93919 764f2b SizeofResource 93918->93919 93919->93917 93920 764f3f LockResource 93919->93920 93920->93917 93922 6f4526 93921->93922 93925 764fe0 93921->93925 93927 713a8d 93922->93927 93924 6f4534 93924->93802 93926->93793 93928 713a99 _doexit 93927->93928 93929 713aa7 93928->93929 93931 713acd 93928->93931 93940 717c0e 47 API calls __getptd_noexit 93929->93940 93942 714e1c 93931->93942 93932 713aac 93941 716e10 8 API calls __ftell_nolock 93932->93941 93937 713ae2 93949 713b04 LeaveCriticalSection LeaveCriticalSection _fprintf 93937->93949 93939 713ab7 _doexit 93939->93924 93940->93932 93941->93939 93943 714e2c 93942->93943 93944 714e4e EnterCriticalSection 93942->93944 93943->93944 93946 714e34 93943->93946 93945 713ad3 93944->93945 93948 7139fe 81 API calls 2 library calls 93945->93948 93947 717cf4 __lock 47 API calls 93946->93947 93947->93945 93948->93937 93949->93939 93953 713839 93950->93953 93952 6f4510 93952->93812 93954 713845 _doexit 93953->93954 93955 713888 93954->93955 93956 71385b _memset 93954->93956 93957 713880 _doexit 93954->93957 93958 714e1c __lock_file 48 API calls 93955->93958 93980 717c0e 47 API calls __getptd_noexit 93956->93980 93957->93952 93959 71388e 93958->93959 93966 71365b 93959->93966 93962 713875 93981 716e10 8 API calls __ftell_nolock 93962->93981 93967 713691 93966->93967 93970 713676 _memset 93966->93970 93982 7138c2 LeaveCriticalSection LeaveCriticalSection _fprintf 93967->93982 93968 713681 94081 717c0e 47 API calls __getptd_noexit 93968->94081 93970->93967 93970->93968 93974 7136cf 93970->93974 93973 7137e0 _memset 94084 717c0e 47 API calls __getptd_noexit 93973->94084 93974->93967 93974->93973 93983 712933 93974->93983 93990 71ee0e 93974->93990 94061 71eb66 93974->94061 94083 71ec87 47 API calls 3 library calls 93974->94083 93978 713686 94082 716e10 8 API calls __ftell_nolock 93978->94082 93980->93962 93981->93957 93982->93957 93984 712952 93983->93984 93985 71293d 93983->93985 93984->93974 93986 717c0e __ftell_nolock 47 API calls 93985->93986 93987 712942 93986->93987 93988 716e10 __ftell_nolock 8 API calls 93987->93988 93989 71294d 93988->93989 93989->93974 93991 71ee46 93990->93991 93992 71ee2f 93990->93992 93994 71f57e 93991->93994 93999 71ee80 93991->93999 93993 717bda __lseeki64 47 API calls 93992->93993 93996 71ee34 93993->93996 93995 717bda __lseeki64 47 API calls 93994->93995 93997 71f583 93995->93997 93998 717c0e __ftell_nolock 47 API calls 93996->93998 94000 717c0e __ftell_nolock 47 API calls 93997->94000 94044 71ee3b 93998->94044 94001 71ee88 93999->94001 94007 71ee9f 93999->94007 94002 71ee94 94000->94002 94003 717bda __lseeki64 47 API calls 94001->94003 94005 716e10 __ftell_nolock 8 API calls 94002->94005 94004 71ee8d 94003->94004 94008 717c0e __ftell_nolock 47 API calls 94004->94008 94005->94044 94006 71eeb4 94009 717bda __lseeki64 47 API calls 94006->94009 94007->94006 94010 71eece 94007->94010 94011 71eeec 94007->94011 94007->94044 94008->94002 94009->94004 94010->94006 94016 71eed9 94010->94016 94013 7169d0 __malloc_crt 47 API calls 94011->94013 94014 71eefc 94013->94014 94017 71ef04 94014->94017 94018 71ef1f 94014->94018 94015 723bf2 __stbuf 47 API calls 94019 71efed 94015->94019 94016->94015 94020 717c0e __ftell_nolock 47 API calls 94017->94020 94022 71f82f __lseeki64_nolock 49 API calls 94018->94022 94021 71f066 ReadFile 94019->94021 94026 71f003 GetConsoleMode 94019->94026 94023 71ef09 94020->94023 94024 71f546 GetLastError 94021->94024 94025 71f088 94021->94025 94027 71ef2d 94022->94027 94028 717bda __lseeki64 47 API calls 94023->94028 94029 71f553 94024->94029 94030 71f046 94024->94030 94025->94024 94035 71f058 94025->94035 94031 71f063 94026->94031 94032 71f017 94026->94032 94027->94016 94033 71ef14 94028->94033 94034 717c0e __ftell_nolock 47 API calls 94029->94034 94037 71f04c 94030->94037 94040 717bed __dosmaperr 47 API calls 94030->94040 94031->94021 94032->94031 94036 71f01d ReadConsoleW 94032->94036 94033->94044 94038 71f558 94034->94038 94035->94037 94042 71f32a 94035->94042 94043 71f0bd 94035->94043 94036->94035 94039 71f040 GetLastError 94036->94039 94037->94044 94045 711c9d _free 47 API calls 94037->94045 94041 717bda __lseeki64 47 API calls 94038->94041 94039->94030 94040->94037 94041->94037 94042->94037 94052 71f430 ReadFile 94042->94052 94047 71f129 ReadFile 94043->94047 94048 71f1aa 94043->94048 94044->93974 94045->94044 94049 71f14a GetLastError 94047->94049 94059 71f154 94047->94059 94048->94037 94050 71f267 94048->94050 94051 71f257 94048->94051 94055 71f217 MultiByteToWideChar 94048->94055 94049->94059 94050->94055 94056 71f82f __lseeki64_nolock 49 API calls 94050->94056 94053 717c0e __ftell_nolock 47 API calls 94051->94053 94054 71f453 GetLastError 94052->94054 94060 71f461 94052->94060 94053->94037 94054->94060 94055->94037 94055->94039 94056->94055 94057 71f82f __lseeki64_nolock 49 API calls 94057->94059 94058 71f82f __lseeki64_nolock 49 API calls 94058->94060 94059->94043 94059->94057 94060->94042 94060->94058 94062 71eb71 94061->94062 94066 71eb86 94061->94066 94063 717c0e __ftell_nolock 47 API calls 94062->94063 94064 71eb76 94063->94064 94065 716e10 __ftell_nolock 8 API calls 94064->94065 94073 71eb81 94065->94073 94067 71ebbb 94066->94067 94068 723e24 __getbuf 47 API calls 94066->94068 94066->94073 94069 712933 __ftell_nolock 47 API calls 94067->94069 94068->94067 94070 71ebcf 94069->94070 94071 71ed06 __filbuf 62 API calls 94070->94071 94072 71ebd6 94071->94072 94072->94073 94074 712933 __ftell_nolock 47 API calls 94072->94074 94073->93974 94075 71ebf9 94074->94075 94075->94073 94076 712933 __ftell_nolock 47 API calls 94075->94076 94077 71ec05 94076->94077 94077->94073 94078 712933 __ftell_nolock 47 API calls 94077->94078 94079 71ec12 94078->94079 94080 712933 __ftell_nolock 47 API calls 94079->94080 94080->94073 94081->93978 94082->93967 94083->93974 94084->93978 94088 71344a GetSystemTimeAsFileTime 94085->94088 94087 73bdc3 94087->93814 94089 713478 __aulldiv 94088->94089 94089->94087 94091 713e71 _doexit 94090->94091 94092 713e94 94091->94092 94093 713e7f 94091->94093 94095 714e1c __lock_file 48 API calls 94092->94095 94104 717c0e 47 API calls __getptd_noexit 94093->94104 94097 713e9a 94095->94097 94096 713e84 94105 716e10 8 API calls __ftell_nolock 94096->94105 94106 713b0c 55 API calls 2 library calls 94097->94106 94100 713ea5 94107 713ec5 LeaveCriticalSection LeaveCriticalSection _fprintf 94100->94107 94101 713e8f _doexit 94101->93819 94103 713eb7 94103->94101 94104->94096 94105->94101 94106->94100 94107->94103 94110 73c581 __tzset_nolock _wcscmp 94108->94110 94109 6f44ed 64 API calls 94109->94110 94110->94109 94111 73bf5a GetSystemTimeAsFileTime 94110->94111 94112 73c417 94110->94112 94113 6f4517 83 API calls 94110->94113 94111->94110 94112->93735 94112->93736 94113->94110 94115 73b970 94114->94115 94117 73b97e 94114->94117 94116 713499 117 API calls 94115->94116 94116->94117 94118 73b9c3 94117->94118 94119 713499 117 API calls 94117->94119 94144 73b987 94117->94144 94145 73bbe8 94118->94145 94120 73b9a8 94119->94120 94120->94118 94122 73b9b1 94120->94122 94126 7135e4 __fcloseall 83 API calls 94122->94126 94122->94144 94123 73ba07 94124 73ba0b 94123->94124 94125 73ba2c 94123->94125 94128 73ba18 94124->94128 94130 7135e4 __fcloseall 83 API calls 94124->94130 94149 73b7e5 94125->94149 94126->94144 94131 7135e4 __fcloseall 83 API calls 94128->94131 94128->94144 94130->94128 94131->94144 94132 73ba5a 94158 73ba8a 94132->94158 94133 73ba3a 94135 73ba47 94133->94135 94137 7135e4 __fcloseall 83 API calls 94133->94137 94139 7135e4 __fcloseall 83 API calls 94135->94139 94135->94144 94137->94135 94139->94144 94141 73ba75 94143 7135e4 __fcloseall 83 API calls 94141->94143 94141->94144 94143->94144 94144->93764 94146 73bc0d 94145->94146 94148 73bbf6 __tzset_nolock ___crtGetEnvironmentStringsW 94145->94148 94147 71381e __fread_nolock 64 API calls 94146->94147 94147->94148 94148->94123 94150 71395c _W_store_winword 47 API calls 94149->94150 94151 73b7f4 94150->94151 94152 71395c _W_store_winword 47 API calls 94151->94152 94153 73b808 94152->94153 94154 71395c _W_store_winword 47 API calls 94153->94154 94155 73b81c 94154->94155 94156 73bb64 47 API calls 94155->94156 94157 73b82f 94155->94157 94156->94157 94157->94132 94157->94133 94162 73baa0 94158->94162 94159 73bb51 94191 73bd8a 94159->94191 94161 73b841 64 API calls 94161->94162 94162->94159 94162->94161 94165 73ba61 94162->94165 94187 73bc67 94162->94187 94195 73b942 64 API calls 94162->94195 94166 73bb64 94165->94166 94167 73bb71 94166->94167 94168 73bb77 94166->94168 94169 711c9d _free 47 API calls 94167->94169 94170 711c9d _free 47 API calls 94168->94170 94171 73bb88 94168->94171 94169->94168 94170->94171 94172 711c9d _free 47 API calls 94171->94172 94173 73ba68 94171->94173 94172->94173 94173->94141 94174 7135e4 94173->94174 94175 7135f0 _doexit 94174->94175 94176 713604 94175->94176 94177 71361c 94175->94177 94229 717c0e 47 API calls __getptd_noexit 94176->94229 94180 714e1c __lock_file 48 API calls 94177->94180 94183 713614 _doexit 94177->94183 94179 713609 94230 716e10 8 API calls __ftell_nolock 94179->94230 94182 71362e 94180->94182 94213 713578 94182->94213 94183->94141 94189 73bc76 94187->94189 94190 73bcb6 94187->94190 94189->94162 94190->94189 94196 73bd3d 94190->94196 94192 73bda8 94191->94192 94193 73bd97 94191->94193 94192->94165 94194 712aae 80 API calls 94193->94194 94194->94192 94195->94162 94197 73bd7a 94196->94197 94198 73bd69 94196->94198 94197->94190 94200 712aae 94198->94200 94201 712aba _doexit 94200->94201 94202 712ad4 94201->94202 94203 712aec 94201->94203 94212 712ae4 _doexit 94201->94212 94205 717c0e __ftell_nolock 47 API calls 94202->94205 94204 714e1c __lock_file 48 API calls 94203->94204 94206 712af2 94204->94206 94207 712ad9 94205->94207 94208 712957 78 API calls 94206->94208 94209 716e10 __ftell_nolock 8 API calls 94207->94209 94210 712b06 94208->94210 94209->94212 94211 712b24 LeaveCriticalSection LeaveCriticalSection 94210->94211 94211->94212 94212->94197 94214 713587 94213->94214 94216 71359b 94213->94216 94265 717c0e 47 API calls __getptd_noexit 94214->94265 94217 713597 94216->94217 94232 712c84 94216->94232 94231 713653 LeaveCriticalSection LeaveCriticalSection _fprintf 94217->94231 94218 71358c 94266 716e10 8 API calls __ftell_nolock 94218->94266 94224 712933 __ftell_nolock 47 API calls 94225 7135b5 94224->94225 94242 71e9d2 94225->94242 94227 7135bb 94227->94217 94228 711c9d _free 47 API calls 94227->94228 94228->94217 94229->94179 94230->94183 94231->94183 94233 712c97 94232->94233 94237 712cbb 94232->94237 94234 712933 __ftell_nolock 47 API calls 94233->94234 94233->94237 94235 712cb4 94234->94235 94267 71af61 94235->94267 94238 71eb36 94237->94238 94239 71eb43 94238->94239 94241 7135af 94238->94241 94240 711c9d _free 47 API calls 94239->94240 94239->94241 94240->94241 94241->94224 94243 71e9de _doexit 94242->94243 94244 71e9e6 94243->94244 94245 71e9fe 94243->94245 94316 717bda 47 API calls __getptd_noexit 94244->94316 94247 71ea7b 94245->94247 94252 71ea28 94245->94252 94320 717bda 47 API calls __getptd_noexit 94247->94320 94248 71e9eb 94317 717c0e 47 API calls __getptd_noexit 94248->94317 94251 71ea80 94321 717c0e 47 API calls __getptd_noexit 94251->94321 94292 71a8ed 94252->94292 94255 71ea88 94322 716e10 8 API calls __ftell_nolock 94255->94322 94256 71ea2e 94258 71ea41 94256->94258 94259 71ea4c 94256->94259 94301 71ea9c 94258->94301 94318 717c0e 47 API calls __getptd_noexit 94259->94318 94262 71e9f3 _doexit 94262->94227 94263 71ea47 94319 71ea73 LeaveCriticalSection __unlock_fhandle 94263->94319 94265->94218 94266->94217 94268 71af6d _doexit 94267->94268 94269 71af75 94268->94269 94274 71af8d 94268->94274 94270 717bda __lseeki64 47 API calls 94269->94270 94272 71af7a 94270->94272 94271 71b022 94273 717bda __lseeki64 47 API calls 94271->94273 94275 717c0e __ftell_nolock 47 API calls 94272->94275 94276 71b027 94273->94276 94274->94271 94277 71afbf 94274->94277 94286 71af82 _doexit 94275->94286 94278 717c0e __ftell_nolock 47 API calls 94276->94278 94279 71a8ed ___lock_fhandle 49 API calls 94277->94279 94280 71b02f 94278->94280 94281 71afc5 94279->94281 94282 716e10 __ftell_nolock 8 API calls 94280->94282 94283 71afd8 94281->94283 94284 71afeb 94281->94284 94282->94286 94285 71b043 __chsize_nolock 75 API calls 94283->94285 94287 717c0e __ftell_nolock 47 API calls 94284->94287 94288 71afe4 94285->94288 94286->94237 94289 71aff0 94287->94289 94291 71b01a __flswbuf LeaveCriticalSection 94288->94291 94290 717bda __lseeki64 47 API calls 94289->94290 94290->94288 94291->94286 94293 71a8f9 _doexit 94292->94293 94294 71a946 EnterCriticalSection 94293->94294 94296 717cf4 __lock 47 API calls 94293->94296 94295 71a96c _doexit 94294->94295 94295->94256 94297 71a91d 94296->94297 94298 71a928 InitializeCriticalSectionAndSpinCount 94297->94298 94299 71a93a 94297->94299 94298->94299 94300 71a970 ___lock_fhandle LeaveCriticalSection 94299->94300 94300->94294 94302 71aba4 __lseeki64_nolock 47 API calls 94301->94302 94305 71eaaa 94302->94305 94303 71eb00 94304 71ab1e __free_osfhnd 48 API calls 94303->94304 94307 71eb08 94304->94307 94305->94303 94308 71aba4 __lseeki64_nolock 47 API calls 94305->94308 94315 71eade 94305->94315 94306 71aba4 __lseeki64_nolock 47 API calls 94309 71eaea CloseHandle 94306->94309 94313 717bed __dosmaperr 47 API calls 94307->94313 94314 71eb2a 94307->94314 94310 71ead5 94308->94310 94309->94303 94312 71eaf6 GetLastError 94309->94312 94311 71aba4 __lseeki64_nolock 47 API calls 94310->94311 94311->94315 94312->94303 94313->94314 94314->94263 94315->94303 94315->94306 94316->94248 94317->94262 94318->94263 94319->94262 94320->94251 94321->94255 94322->94262 94323->93640 94324->93647 94325->93655 94326->93655 94327->93658 94328->93671 94329->93673 94330->93670 94331->93678 94332->93684 94333->93697 94334->93692 94336 71f8a0 __ftell_nolock 94335->94336 94337 6f40b4 GetLongPathNameW 94336->94337 94338 6f6a63 48 API calls 94337->94338 94339 6f40dc 94338->94339 94340 6f49a0 94339->94340 94341 6fd7f7 48 API calls 94340->94341 94342 6f49b2 94341->94342 94343 6f660f 49 API calls 94342->94343 94344 6f49bd 94343->94344 94345 6f49c8 94344->94345 94349 762e35 94344->94349 94346 6f64cf 48 API calls 94345->94346 94348 6f49d4 94346->94348 94387 6f28a6 94348->94387 94351 762e4f 94349->94351 94393 70d35e 60 API calls 94349->94393 94352 6f49e7 Mailbox 94352->93499 94354 6f41a9 136 API calls 94353->94354 94355 6f415e 94354->94355 94356 763489 94355->94356 94357 6f41a9 136 API calls 94355->94357 94358 73c396 122 API calls 94356->94358 94359 6f4172 94357->94359 94360 76349e 94358->94360 94359->94356 94361 6f417a 94359->94361 94362 7634a2 94360->94362 94363 7634bf 94360->94363 94365 6f4186 94361->94365 94366 7634aa 94361->94366 94367 6f4252 84 API calls 94362->94367 94364 70f4ea 48 API calls 94363->94364 94376 763504 Mailbox 94364->94376 94394 6fc833 94365->94394 94482 736b49 87 API calls _wprintf 94366->94482 94367->94366 94371 7634b8 94371->94363 94372 7636b4 94373 711c9d _free 47 API calls 94372->94373 94374 7636bc 94373->94374 94375 6f4252 84 API calls 94374->94375 94381 7636c5 94375->94381 94376->94372 94376->94381 94384 6fce19 48 API calls 94376->94384 94483 732551 48 API calls ___crtGetEnvironmentStringsW 94376->94483 94484 732472 60 API calls 2 library calls 94376->94484 94485 739c12 48 API calls 94376->94485 94486 6fba85 48 API calls ___crtGetEnvironmentStringsW 94376->94486 94487 6f4dd9 48 API calls 94376->94487 94380 711c9d _free 47 API calls 94380->94381 94381->94380 94382 6f4252 84 API calls 94381->94382 94488 7325b5 86 API calls 4 library calls 94381->94488 94382->94381 94384->94376 94388 6f28b8 94387->94388 94392 6f28d7 ___crtGetEnvironmentStringsW 94387->94392 94391 70f4ea 48 API calls 94388->94391 94389 70f4ea 48 API calls 94390 6f28ee 94389->94390 94390->94352 94391->94392 94392->94389 94393->94349 94395 6fc843 __ftell_nolock 94394->94395 94396 763095 94395->94396 94397 6fc860 94395->94397 94513 7325b5 86 API calls 4 library calls 94396->94513 94494 6f48ba 49 API calls 94397->94494 94400 6fc882 94495 6f4550 56 API calls 94400->94495 94401 7630a8 94514 7325b5 86 API calls 4 library calls 94401->94514 94403 6fc897 94403->94401 94404 6fc89f 94403->94404 94407 6fd7f7 48 API calls 94404->94407 94406 7630c4 94409 6fc90c 94406->94409 94408 6fc8ab 94407->94408 94496 70e968 49 API calls __ftell_nolock 94408->94496 94411 7630d7 94409->94411 94412 6fc91a 94409->94412 94415 6f4907 CloseHandle 94411->94415 94499 711dfc 94412->94499 94413 6fc8b7 94416 6fd7f7 48 API calls 94413->94416 94417 7630e3 94415->94417 94418 6fc8c3 94416->94418 94419 6f41a9 136 API calls 94417->94419 94420 6f660f 49 API calls 94418->94420 94421 76310d 94419->94421 94422 6fc8d1 94420->94422 94424 763136 94421->94424 94427 73c396 122 API calls 94421->94427 94497 70eb66 SetFilePointerEx ReadFile 94422->94497 94423 6fc943 _wcscat _wcscpy 94426 6fc96d SetCurrentDirectoryW 94423->94426 94515 7325b5 86 API calls 4 library calls 94424->94515 94430 70f4ea 48 API calls 94426->94430 94431 763129 94427->94431 94428 6fc8fd 94498 6f46ce SetFilePointerEx SetFilePointerEx 94428->94498 94434 6fc988 94430->94434 94435 763152 94431->94435 94436 763131 94431->94436 94433 76314d 94465 6fcad1 Mailbox 94433->94465 94438 6f47b7 48 API calls 94434->94438 94437 6f4252 84 API calls 94435->94437 94439 6f4252 84 API calls 94436->94439 94440 763157 94437->94440 94469 6fc993 Mailbox __wsetenvp 94438->94469 94439->94424 94441 70f4ea 48 API calls 94440->94441 94448 763194 94441->94448 94442 6fca9d 94509 6f4907 94442->94509 94446 6f3d98 94446->93373 94446->93396 94516 6fba85 48 API calls ___crtGetEnvironmentStringsW 94448->94516 94452 7633ce 94522 739b72 48 API calls 94452->94522 94453 763467 94526 7325b5 86 API calls 4 library calls 94453->94526 94456 763480 94456->94442 94458 7633f0 94523 7529e8 48 API calls ___crtGetEnvironmentStringsW 94458->94523 94460 7633fd 94461 711c9d _free 47 API calls 94460->94461 94461->94465 94463 76345f 94525 73240b 48 API calls 3 library calls 94463->94525 94489 6f48dd 94465->94489 94466 6fce19 48 API calls 94466->94469 94469->94442 94469->94453 94469->94463 94469->94466 94502 6fb337 56 API calls _wcscpy 94469->94502 94503 70c258 GetStringTypeW 94469->94503 94504 6fcb93 59 API calls __wcsnicmp 94469->94504 94505 6fcb5a GetStringTypeW __wsetenvp 94469->94505 94506 7116d0 GetStringTypeW __towlower_l 94469->94506 94507 6fcc24 162 API calls 3 library calls 94469->94507 94508 70c682 48 API calls 94469->94508 94473 6fce19 48 API calls 94478 7631dd Mailbox 94473->94478 94476 763420 94524 7325b5 86 API calls 4 library calls 94476->94524 94478->94452 94478->94473 94478->94476 94517 732551 48 API calls ___crtGetEnvironmentStringsW 94478->94517 94518 732472 60 API calls 2 library calls 94478->94518 94519 739c12 48 API calls 94478->94519 94520 6fba85 48 API calls ___crtGetEnvironmentStringsW 94478->94520 94521 70c682 48 API calls 94478->94521 94479 763439 94480 711c9d _free 47 API calls 94479->94480 94481 76344c 94480->94481 94481->94465 94482->94371 94483->94376 94484->94376 94485->94376 94486->94376 94487->94376 94488->94381 94490 6f4907 CloseHandle 94489->94490 94491 6f48e5 Mailbox 94490->94491 94492 6f4907 CloseHandle 94491->94492 94493 6f48fc 94492->94493 94493->94446 94494->94400 94495->94403 94496->94413 94497->94428 94498->94409 94527 711e46 94499->94527 94502->94469 94503->94469 94504->94469 94505->94469 94506->94469 94507->94469 94508->94469 94510 6f4911 SetCurrentDirectoryW 94509->94510 94511 6f4920 94509->94511 94510->94465 94511->94510 94512 6f4925 CloseHandle 94511->94512 94512->94510 94513->94401 94514->94406 94515->94433 94516->94478 94517->94478 94518->94478 94519->94478 94520->94478 94521->94478 94522->94458 94523->94460 94524->94479 94525->94453 94526->94456 94528 711e61 94527->94528 94531 711e55 94527->94531 94551 717c0e 47 API calls __getptd_noexit 94528->94551 94530 712019 94533 711e41 94530->94533 94552 716e10 8 API calls __ftell_nolock 94530->94552 94531->94528 94537 711ed4 94531->94537 94546 719d6b 47 API calls __ftell_nolock 94531->94546 94533->94423 94534 711f41 94536 711fa0 94534->94536 94538 711f5f 94534->94538 94536->94528 94536->94533 94539 711fb0 94536->94539 94537->94528 94537->94534 94547 719d6b 47 API calls __ftell_nolock 94537->94547 94538->94528 94543 711f7b 94538->94543 94548 719d6b 47 API calls __ftell_nolock 94538->94548 94550 719d6b 47 API calls __ftell_nolock 94539->94550 94542 711f91 94549 719d6b 47 API calls __ftell_nolock 94542->94549 94543->94528 94543->94533 94543->94542 94546->94537 94547->94534 94548->94543 94549->94533 94550->94533 94551->94530 94552->94533 94554 6f4c8b 94553->94554 94555 6f4d94 94553->94555 94554->94555 94556 70f4ea 48 API calls 94554->94556 94555->93505 94557 6f4cb2 94556->94557 94558 70f4ea 48 API calls 94557->94558 94562 6f4d22 94558->94562 94562->94555 94566 6fb470 94562->94566 94594 6f4dd9 48 API calls 94562->94594 94595 739af1 48 API calls 94562->94595 94596 6fba85 48 API calls ___crtGetEnvironmentStringsW 94562->94596 94564->93507 94565->93509 94597 6f6b0f 94566->94597 94568 6fb69b 94604 6fba85 48 API calls ___crtGetEnvironmentStringsW 94568->94604 94570 6fb6b5 Mailbox 94570->94562 94573 763939 ___crtGetEnvironmentStringsW 94614 7326bc 88 API calls 4 library calls 94573->94614 94574 6fb495 94574->94568 94574->94573 94575 76397b 94574->94575 94576 6fba85 48 API calls 94574->94576 94582 6fbcce 48 API calls 94574->94582 94585 6fb9e4 94574->94585 94586 763909 94574->94586 94587 6fbb85 48 API calls 94574->94587 94591 6fbdfa 48 API calls 94574->94591 94602 6fc413 59 API calls 94574->94602 94603 6fbc74 48 API calls 94574->94603 94605 6fc6a5 49 API calls 94574->94605 94606 6fc799 94574->94606 94615 7326bc 88 API calls 4 library calls 94575->94615 94576->94574 94580 763973 94580->94570 94582->94574 94583 763989 94616 6fba85 48 API calls ___crtGetEnvironmentStringsW 94583->94616 94617 7326bc 88 API calls 4 library calls 94585->94617 94588 6f6b4a 48 API calls 94586->94588 94587->94574 94590 763914 94588->94590 94593 70f4ea 48 API calls 94590->94593 94592 6fb66c CharUpperBuffW 94591->94592 94592->94574 94593->94573 94594->94562 94595->94562 94596->94562 94598 70f4ea 48 API calls 94597->94598 94599 6f6b34 94598->94599 94600 6f6b4a 48 API calls 94599->94600 94601 6f6b43 94600->94601 94601->94574 94602->94574 94603->94574 94604->94570 94605->94574 94607 761f17 94606->94607 94610 6fc7b0 94606->94610 94608 6f6b4a 48 API calls 94607->94608 94609 761f21 94608->94609 94612 70f4ea 48 API calls 94609->94612 94611 6fc7bd ___crtGetEnvironmentStringsW 94610->94611 94613 70ee75 48 API calls 94610->94613 94611->94574 94612->94611 94613->94611 94614->94580 94615->94583 94616->94580 94617->94580 94619 6f403c LoadImageW 94618->94619 94620 76418d EnumResourceNamesW 94618->94620 94621 6f3ee1 RegisterClassExW 94619->94621 94620->94621 94622 6f3f53 7 API calls 94621->94622 94622->93524 94624 763c33 94623->94624 94625 6f4c44 94623->94625 94624->94625 94626 763c3c DestroyIcon 94624->94626 94625->93530 94649 735819 61 API calls _W_store_winword 94625->94649 94626->94625 94628 6f51cb 94627->94628 94648 6f52a2 Mailbox 94627->94648 94629 6f6b0f 48 API calls 94628->94629 94630 6f51d9 94629->94630 94631 763ca1 LoadStringW 94630->94631 94632 6f51e6 94630->94632 94648->93535 94649->93530 94651 6fef2f 94650->94651 94652 6fef1d 94650->94652 94860 73cc5c 86 API calls 4 library calls 94651->94860 94652->93596 94654 7686f9 94654->94654 94656 6ff130 94655->94656 94659 6ffe30 335 API calls 94656->94659 94663 6ff199 94656->94663 94657 6ff3dd 94660 7687c8 94657->94660 94672 6ff3f2 94657->94672 94705 6ff431 Mailbox 94657->94705 94658 6ff595 94666 6fd7f7 48 API calls 94658->94666 94658->94705 94661 768728 94659->94661 94865 73cc5c 86 API calls 4 library calls 94660->94865 94661->94663 94862 73cc5c 86 API calls 4 library calls 94661->94862 94663->94657 94663->94658 94667 6fd7f7 48 API calls 94663->94667 94699 6ff229 94663->94699 94664 6ffe30 335 API calls 94664->94705 94668 7687a3 94666->94668 94669 768772 94667->94669 94864 710f0a 52 API calls __cinit 94668->94864 94863 710f0a 52 API calls __cinit 94669->94863 94670 73cc5c 86 API calls 94670->94705 94698 6ff418 94672->94698 94866 739af1 48 API calls 94672->94866 94673 768b1b 94687 768bcf 94673->94687 94688 768b2c 94673->94688 94675 6fd6e9 55 API calls 94675->94705 94677 6ff770 94679 768a45 94677->94679 94697 6ff77a 94677->94697 94678 768c53 94880 73cc5c 86 API calls 4 library calls 94678->94880 94680 768810 94867 74eef8 335 API calls 94680->94867 94681 6ffe30 335 API calls 94700 6ff6aa 94681->94700 94682 768b7e 94875 74e40a 335 API calls Mailbox 94682->94875 94877 73cc5c 86 API calls 4 library calls 94687->94877 94874 74f5ee 335 API calls 94688->94874 94689 768beb 94878 74bdbd 335 API calls Mailbox 94689->94878 94695 701b90 48 API calls 94695->94705 94696 768c00 94719 6ff537 Mailbox 94696->94719 94698->94673 94698->94700 94698->94705 94699->94657 94699->94658 94699->94698 94699->94705 94700->94677 94700->94681 94703 6ffce0 94700->94703 94700->94705 94700->94719 94703->94719 94876 73cc5c 86 API calls 4 library calls 94703->94876 94705->94664 94705->94670 94705->94675 94705->94678 94705->94682 94705->94689 94705->94695 94705->94703 94705->94719 94861 6fdd47 48 API calls ___crtGetEnvironmentStringsW 94705->94861 94873 7297ed InterlockedDecrement 94705->94873 94881 70c1af 48 API calls 94705->94881 94719->93596 94721 704637 94720->94721 94722 70479f 94720->94722 94723 766e05 94721->94723 94724 704643 94721->94724 94725 6fce19 48 API calls 94722->94725 94936 74e822 94723->94936 94935 704300 335 API calls ___crtGetEnvironmentStringsW 94724->94935 94732 7046e4 Mailbox 94725->94732 94728 766e11 94729 704739 Mailbox 94728->94729 94976 73cc5c 86 API calls 4 library calls 94728->94976 94729->93596 94731 704659 94731->94728 94731->94729 94731->94732 94735 6f4252 84 API calls 94732->94735 94882 73fa0c 94732->94882 94923 736524 94732->94923 94926 746ff0 94732->94926 94735->94729 94738 76df42 94737->94738 94741 70e253 94737->94741 94739 76df77 94738->94739 94740 76df59 TranslateAcceleratorW 94738->94740 94740->94741 94741->93596 94743 70dca3 94742->94743 94744 70dc71 94742->94744 94743->93596 94744->94743 94745 70dc96 IsDialogMessageW 94744->94745 94746 76dd1d GetClassLongW 94744->94746 94745->94743 94745->94744 94746->94744 94746->94745 94747->93596 95080 6fbd30 94748->95080 94750 703267 94751 7032f8 94750->94751 94752 76907a 94750->94752 94818 703628 94750->94818 95092 70c36b 86 API calls 94751->95092 95098 73cc5c 86 API calls 4 library calls 94752->95098 94756 7694df 94756->94818 94758 703313 94758->94756 94766 7034eb Mailbox ___crtGetEnvironmentStringsW 94758->94766 94758->94818 95085 6f2b7a 94758->95085 94766->94818 94819 703635 Mailbox 94818->94819 95097 73cc5c 86 API calls 4 library calls 94818->95097 94819->93596 94820->93540 94821->93543 94822->93548 94823->93596 94824->93596 94825->93591 94826->93591 94827->93591 94829 6ffe50 94828->94829 94854 6ffe7e 94828->94854 94830 70f4ea 48 API calls 94829->94830 94830->94854 94831 70146e 94832 6f6eed 48 API calls 94831->94832 94853 6fffe1 94832->94853 94833 7297ed InterlockedDecrement 94833->94854 94834 700509 95122 73cc5c 86 API calls 4 library calls 94834->95122 94835 70f4ea 48 API calls 94835->94854 94838 6f6eed 48 API calls 94838->94854 94840 701473 95121 73cc5c 86 API calls 4 library calls 94840->95121 94841 76a246 94843 6f6eed 48 API calls 94841->94843 94842 76a922 94842->93596 94843->94853 94846 76a873 94846->93596 94847 6fd7f7 48 API calls 94847->94854 94848 76a30e 94848->94853 95119 7297ed InterlockedDecrement 94848->95119 94849 710f0a 52 API calls __cinit 94849->94854 94851 76a973 95123 73cc5c 86 API calls 4 library calls 94851->95123 94853->93596 94854->94831 94854->94833 94854->94834 94854->94835 94854->94838 94854->94840 94854->94841 94854->94847 94854->94848 94854->94849 94854->94851 94854->94853 94856 7015b5 94854->94856 95117 701820 335 API calls 2 library calls 94854->95117 95118 701d10 59 API calls Mailbox 94854->95118 94855 76a982 95120 73cc5c 86 API calls 4 library calls 94856->95120 94857->93591 94858->93591 94859->93591 94860->94654 94861->94705 94862->94663 94863->94699 94864->94705 94865->94719 94866->94680 94873->94705 94874->94705 94875->94703 94876->94719 94877->94719 94878->94696 94880->94719 94881->94705 94883 73fa1c __ftell_nolock 94882->94883 94884 73fa44 94883->94884 95058 6fd286 48 API calls 94883->95058 94977 6f936c 94884->94977 95067 736ca9 GetFileAttributesW 94923->95067 94927 6f936c 81 API calls 94926->94927 94928 74702a 94927->94928 94929 6fb470 91 API calls 94928->94929 94935->94731 94937 74e84e 94936->94937 94938 74e868 94936->94938 95072 73cc5c 86 API calls 4 library calls 94937->95072 95073 74ccdc 48 API calls 94938->95073 94941 74e871 94942 6ffe30 334 API calls 94941->94942 94969 74e860 Mailbox 94969->94728 94976->94729 94995 6f9380 94977->94995 95058->94884 95068 736529 95067->95068 95069 736cc4 FindFirstFileW 95067->95069 95068->94729 95069->95068 95070 736cd9 FindClose 95069->95070 95070->95068 95072->94969 95073->94941 95081 6fbd3f 95080->95081 95084 6fbd5a 95080->95084 95082 6fbdfa 48 API calls 95081->95082 95083 6fbd47 CharUpperBuffW 95082->95083 95083->95084 95084->94750 95092->94758 95097->94819 95098->94758 95117->94854 95118->94854 95119->94853 95120->94853 95121->94846 95122->94842 95123->94855 95125 6fb392 95124->95125 95132 6fb3c5 ___crtGetEnvironmentStringsW 95124->95132 95126 6fb3fd 95125->95126 95127 6fb3b8 95125->95127 95125->95132 95128 70f4ea 48 API calls 95126->95128 95129 6fbb85 48 API calls 95127->95129 95130 6fb407 95128->95130 95129->95132 95131 70f4ea 48 API calls 95130->95131 95131->95132 95132->93605 95133->93606 95134 7619ba 95139 70c75a 95134->95139 95138 7619c9 95140 6fd7f7 48 API calls 95139->95140 95141 70c7c8 95140->95141 95147 70d26c 95141->95147 95144 70c865 95145 70c881 95144->95145 95150 70d1fa 48 API calls ___crtGetEnvironmentStringsW 95144->95150 95146 710f0a 52 API calls __cinit 95145->95146 95146->95138 95151 70d298 95147->95151 95150->95144 95152 70d2a5 95151->95152 95154 70d28b 95151->95154 95153 70d2ac RegOpenKeyExW 95152->95153 95152->95154 95153->95154 95155 70d2c6 RegQueryValueExW 95153->95155 95154->95144 95156 70d2e7 95155->95156 95157 70d2fc RegCloseKey 95155->95157 95156->95157 95157->95154 95158 76197b 95163 70dd94 95158->95163 95162 76198a 95164 70f4ea 48 API calls 95163->95164 95165 70dd9c 95164->95165 95166 70ddb0 95165->95166 95171 70df3d 95165->95171 95170 710f0a 52 API calls __cinit 95166->95170 95170->95162 95172 70df46 95171->95172 95174 70dda8 95171->95174 95203 710f0a 52 API calls __cinit 95172->95203 95175 70ddc0 95174->95175 95176 6fd7f7 48 API calls 95175->95176 95177 70ddd7 GetVersionExW 95176->95177 95178 6f6a63 48 API calls 95177->95178 95179 70de1a 95178->95179 95204 70dfb4 95179->95204 95182 6f6571 48 API calls 95183 70de2e 95182->95183 95185 7624c8 95183->95185 95208 70df77 95183->95208 95187 70dea4 GetCurrentProcess 95217 70df5f LoadLibraryA GetProcAddress 95187->95217 95188 70df31 GetSystemInfo 95191 70df0e 95188->95191 95189 70dee3 95211 70e00c 95189->95211 95195 70df21 95191->95195 95196 70df1c FreeLibrary 95191->95196 95193 70debb 95193->95188 95193->95189 95195->95166 95196->95195 95197 70df29 GetSystemInfo 95199 70df03 95197->95199 95198 70def9 95214 70dff4 95198->95214 95199->95191 95202 70df09 FreeLibrary 95199->95202 95202->95191 95203->95174 95205 70dfbd 95204->95205 95206 6fb18b 48 API calls 95205->95206 95207 70de22 95206->95207 95207->95182 95218 70df89 95208->95218 95222 70e01e 95211->95222 95215 70e00c 2 API calls 95214->95215 95216 70df01 GetNativeSystemInfo 95215->95216 95216->95199 95217->95193 95219 70dea0 95218->95219 95220 70df92 LoadLibraryA 95218->95220 95219->95187 95219->95193 95220->95219 95221 70dfa3 GetProcAddress 95220->95221 95221->95219 95223 70def1 95222->95223 95224 70e027 LoadLibraryA 95222->95224 95223->95197 95223->95198 95224->95223 95225 70e038 GetProcAddress 95224->95225 95225->95223 95226 6f3742 95227 6f374b 95226->95227 95228 6f3769 95227->95228 95229 6f37c8 95227->95229 95267 6f37c6 95227->95267 95233 6f382c PostQuitMessage 95228->95233 95234 6f3776 95228->95234 95231 6f37ce 95229->95231 95232 761e00 95229->95232 95230 6f37ab DefWindowProcW 95235 6f37b9 95230->95235 95236 6f37f6 SetTimer RegisterWindowMessageW 95231->95236 95237 6f37d3 95231->95237 95281 6f2ff6 16 API calls 95232->95281 95233->95235 95239 761e88 95234->95239 95240 6f3781 95234->95240 95236->95235 95244 6f381f CreatePopupMenu 95236->95244 95241 761da3 95237->95241 95242 6f37da KillTimer 95237->95242 95286 734ddd 60 API calls _memset 95239->95286 95245 6f3789 95240->95245 95246 6f3836 95240->95246 95248 761ddc MoveWindow 95241->95248 95249 761da8 95241->95249 95278 6f3847 Shell_NotifyIconW _memset 95242->95278 95243 761e27 95282 70e312 335 API calls Mailbox 95243->95282 95244->95235 95252 761e6d 95245->95252 95253 6f3794 95245->95253 95271 70eb83 95246->95271 95248->95235 95256 761dac 95249->95256 95257 761dcb SetFocus 95249->95257 95252->95230 95285 72a5f3 48 API calls 95252->95285 95259 6f379f 95253->95259 95260 761e58 95253->95260 95254 761e9a 95254->95230 95254->95235 95256->95259 95261 761db5 95256->95261 95257->95235 95258 6f37ed 95279 6f390f DeleteObject DestroyWindow Mailbox 95258->95279 95259->95230 95283 6f3847 Shell_NotifyIconW _memset 95259->95283 95284 7355bd 70 API calls _memset 95260->95284 95280 6f2ff6 16 API calls 95261->95280 95266 761e68 95266->95235 95267->95230 95269 761e4c 95270 6f4ffc 67 API calls 95269->95270 95270->95267 95272 70eb9a _memset 95271->95272 95273 70ec1c 95271->95273 95274 6f51af 50 API calls 95272->95274 95273->95235 95276 70ebc1 95274->95276 95275 70ec05 KillTimer SetTimer 95275->95273 95276->95275 95277 763c7a Shell_NotifyIconW 95276->95277 95277->95275 95278->95258 95279->95235 95280->95235 95281->95243 95282->95259 95283->95269 95284->95266 95285->95267 95286->95254 95287 768eb8 95291 73a635 95287->95291 95289 768ec3 95290 73a635 84 API calls 95289->95290 95290->95289 95296 73a66f 95291->95296 95299 73a642 95291->95299 95292 73a671 95303 70ec4e 81 API calls 95292->95303 95293 73a676 95295 6f936c 81 API calls 95293->95295 95297 73a67d 95295->95297 95296->95289 95298 6f510d 48 API calls 95297->95298 95298->95296 95299->95292 95299->95293 95299->95296 95300 73a669 95299->95300 95302 704525 61 API calls ___crtGetEnvironmentStringsW 95300->95302 95302->95296 95303->95293 95304 6fef80 95307 703b70 95304->95307 95306 6fef8c 95308 703bc8 95307->95308 95361 7042a5 95307->95361 95309 703bef 95308->95309 95311 766fd1 95308->95311 95314 766f7e 95308->95314 95320 766f9b 95308->95320 95310 70f4ea 48 API calls 95309->95310 95312 703c18 95310->95312 95387 74ceca 335 API calls Mailbox 95311->95387 95315 70f4ea 48 API calls 95312->95315 95314->95309 95316 766f87 95314->95316 95368 703c2c __wsetenvp ___crtGetEnvironmentStringsW 95315->95368 95384 74d552 335 API calls Mailbox 95316->95384 95317 766fbe 95386 73cc5c 86 API calls 4 library calls 95317->95386 95320->95317 95385 74da0e 335 API calls 2 library calls 95320->95385 95323 703f2b 95323->95306 95324 7673b0 95324->95306 95325 767297 95395 73cc5c 86 API calls 4 library calls 95325->95395 95326 76737a 95405 73cc5c 86 API calls 4 library calls 95326->95405 95331 70dce0 53 API calls 95331->95368 95333 76707e 95388 73cc5c 86 API calls 4 library calls 95333->95388 95334 6fd6e9 55 API calls 95334->95368 95337 7040df 95396 73cc5c 86 API calls 4 library calls 95337->95396 95338 6fd645 53 API calls 95338->95368 95341 7672d2 95397 73cc5c 86 API calls 4 library calls 95341->95397 95343 767350 95403 73cc5c 86 API calls 4 library calls 95343->95403 95345 767363 95404 73cc5c 86 API calls 4 library calls 95345->95404 95347 7672e9 95398 73cc5c 86 API calls 4 library calls 95347->95398 95348 7042f2 95406 73cc5c 86 API calls 4 library calls 95348->95406 95351 6f6a63 48 API calls 95351->95368 95353 76714c 95392 74ccdc 48 API calls 95353->95392 95354 70c050 48 API calls 95354->95368 95355 6ffe30 335 API calls 95355->95368 95357 76733f 95402 73cc5c 86 API calls 4 library calls 95357->95402 95359 6fd286 48 API calls 95359->95368 95399 73cc5c 86 API calls 4 library calls 95361->95399 95362 7671a1 95394 70c15c 48 API calls 95362->95394 95365 70ee75 48 API calls 95365->95368 95366 6f6eed 48 API calls 95366->95368 95368->95323 95368->95325 95368->95326 95368->95331 95368->95333 95368->95334 95368->95337 95368->95338 95368->95341 95368->95343 95368->95345 95368->95347 95368->95348 95368->95351 95368->95353 95368->95354 95368->95355 95368->95357 95368->95359 95368->95361 95368->95365 95368->95366 95369 7671e1 95368->95369 95376 70f4ea 48 API calls 95368->95376 95379 6fd9a0 53 API calls __cinit 95368->95379 95380 6fd83d 53 API calls 95368->95380 95381 6fcdb9 48 API calls 95368->95381 95382 70c15c 48 API calls 95368->95382 95383 70becb 335 API calls 95368->95383 95389 6fdcae 50 API calls Mailbox 95368->95389 95390 74ccdc 48 API calls 95368->95390 95391 73a1eb 50 API calls 95368->95391 95369->95323 95401 73cc5c 86 API calls 4 library calls 95369->95401 95370 76715f 95370->95362 95393 74ccdc 48 API calls 95370->95393 95372 7671ce 95373 70c050 48 API calls 95372->95373 95375 7671d6 95373->95375 95374 7671ab 95374->95361 95374->95372 95375->95369 95377 767313 95375->95377 95376->95368 95400 73cc5c 86 API calls 4 library calls 95377->95400 95379->95368 95380->95368 95381->95368 95382->95368 95383->95368 95384->95323 95385->95317 95386->95311 95387->95368 95388->95323 95389->95368 95390->95368 95391->95368 95392->95370 95393->95370 95394->95374 95395->95337 95396->95323 95397->95347 95398->95323 95399->95323 95400->95323 95401->95323 95402->95323 95403->95323 95404->95323 95405->95323 95406->95324 95407 769c06 95418 70d3be 95407->95418 95409 769c1c 95417 769c91 Mailbox 95409->95417 95427 6f1caa 49 API calls 95409->95427 95411 703200 335 API calls 95412 769cc5 95411->95412 95414 76a7ab Mailbox 95412->95414 95429 73cc5c 86 API calls 4 library calls 95412->95429 95415 769c71 95415->95412 95428 73b171 48 API calls 95415->95428 95417->95411 95419 70d3ca 95418->95419 95420 70d3dc 95418->95420 95430 6fdcae 50 API calls Mailbox 95419->95430 95422 70d3e2 95420->95422 95423 70d40b 95420->95423 95424 70f4ea 48 API calls 95422->95424 95431 6fdcae 50 API calls Mailbox 95423->95431 95426 70d3d4 95424->95426 95426->95409 95427->95415 95428->95417 95429->95414 95430->95426 95431->95426 95432 15b3608 95446 15b1258 95432->95446 95434 15b36e5 95449 15b34f8 95434->95449 95452 15b4708 GetPEB 95446->95452 95448 15b18e3 95448->95434 95450 15b3501 Sleep 95449->95450 95451 15b350f 95450->95451 95453 15b4732 95452->95453 95453->95448 95454 769bec 95489 700ae0 Mailbox ___crtGetEnvironmentStringsW 95454->95489 95456 70f4ea 48 API calls 95456->95489 95459 700509 95549 73cc5c 86 API calls 4 library calls 95459->95549 95461 70146e 95469 6f6eed 48 API calls 95461->95469 95463 6f6eed 48 API calls 95481 6ffec8 95463->95481 95465 701473 95548 73cc5c 86 API calls 4 library calls 95465->95548 95466 70f4ea 48 API calls 95466->95481 95467 76a246 95472 6f6eed 48 API calls 95467->95472 95468 76a922 95484 6fffe1 Mailbox 95469->95484 95472->95484 95474 7297ed InterlockedDecrement 95474->95481 95475 76a873 95476 6fd7f7 48 API calls 95476->95481 95477 76a30e 95477->95484 95544 7297ed InterlockedDecrement 95477->95544 95478 6fce19 48 API calls 95478->95489 95479 710f0a 52 API calls __cinit 95479->95481 95481->95459 95481->95461 95481->95463 95481->95465 95481->95466 95481->95467 95481->95474 95481->95476 95481->95477 95481->95479 95482 76a973 95481->95482 95481->95484 95486 7015b5 95481->95486 95541 701820 335 API calls 2 library calls 95481->95541 95542 701d10 59 API calls Mailbox 95481->95542 95550 73cc5c 86 API calls 4 library calls 95482->95550 95485 76a982 95547 73cc5c 86 API calls 4 library calls 95486->95547 95487 74e822 335 API calls 95487->95489 95488 6ffe30 335 API calls 95488->95489 95489->95456 95489->95478 95489->95481 95489->95484 95489->95487 95489->95488 95490 76a706 95489->95490 95492 701526 Mailbox 95489->95492 95493 7297ed InterlockedDecrement 95489->95493 95494 746ff0 335 API calls 95489->95494 95497 750d09 95489->95497 95500 750d1d 95489->95500 95503 74f0ac 95489->95503 95535 73a6ef 95489->95535 95543 74ef61 82 API calls 2 library calls 95489->95543 95545 73cc5c 86 API calls 4 library calls 95490->95545 95546 73cc5c 86 API calls 4 library calls 95492->95546 95493->95489 95494->95489 95551 74f8ae 95497->95551 95499 750d19 95499->95489 95501 74f8ae 129 API calls 95500->95501 95502 750d2d 95501->95502 95502->95489 95504 6fd7f7 48 API calls 95503->95504 95505 74f0c0 95504->95505 95506 6fd7f7 48 API calls 95505->95506 95507 74f0c8 95506->95507 95508 6fd7f7 48 API calls 95507->95508 95509 74f0d0 95508->95509 95510 6f936c 81 API calls 95509->95510 95521 74f0de 95510->95521 95511 6fc799 48 API calls 95511->95521 95512 6f6a63 48 API calls 95512->95521 95513 74f2f9 Mailbox 95513->95489 95515 74f2b3 95516 6f518c 48 API calls 95515->95516 95519 74f2c0 95516->95519 95517 74f2ce 95520 6f518c 48 API calls 95517->95520 95518 6f6eed 48 API calls 95518->95521 95523 6f510d 48 API calls 95519->95523 95524 74f2dd 95520->95524 95521->95511 95521->95512 95521->95513 95521->95515 95521->95517 95521->95518 95522 6fbdfa 48 API calls 95521->95522 95525 6fbdfa 48 API calls 95521->95525 95527 74f2cc 95521->95527 95532 6f936c 81 API calls 95521->95532 95533 6f518c 48 API calls 95521->95533 95534 6f510d 48 API calls 95521->95534 95526 74f175 CharUpperBuffW 95522->95526 95523->95527 95528 6f510d 48 API calls 95524->95528 95529 74f23a CharUpperBuffW 95525->95529 95530 6fd645 53 API calls 95526->95530 95527->95513 95653 6f6b68 48 API calls 95527->95653 95528->95527 95652 70d922 55 API calls 2 library calls 95529->95652 95530->95521 95532->95521 95533->95521 95534->95521 95536 73a6fb 95535->95536 95537 70f4ea 48 API calls 95536->95537 95538 73a709 95537->95538 95539 6fd7f7 48 API calls 95538->95539 95540 73a717 95538->95540 95539->95540 95540->95489 95541->95481 95542->95481 95543->95489 95544->95484 95545->95492 95546->95484 95547->95484 95548->95475 95549->95468 95550->95485 95552 6f936c 81 API calls 95551->95552 95553 74f8ea 95552->95553 95556 74f92c Mailbox 95553->95556 95587 750567 95553->95587 95555 74fb8b 95557 74fcfa 95555->95557 95560 74fb95 95555->95560 95556->95499 95635 750688 89 API calls Mailbox 95557->95635 95600 74f70a 95560->95600 95561 74fd07 95561->95560 95563 74fd13 95561->95563 95562 6f936c 81 API calls 95580 74f984 Mailbox 95562->95580 95563->95556 95568 74fbc9 95614 70ed18 95568->95614 95571 74fbe3 95633 73cc5c 86 API calls 4 library calls 95571->95633 95572 74fbfd 95574 70c050 48 API calls 95572->95574 95576 74fc14 95574->95576 95575 74fbee GetCurrentProcess TerminateProcess 95575->95572 95577 701b90 48 API calls 95576->95577 95585 74fc3e 95576->95585 95579 74fc2d 95577->95579 95578 74fd65 95578->95556 95583 74fd7e FreeLibrary 95578->95583 95581 75040f 105 API calls 95579->95581 95580->95555 95580->95556 95580->95562 95580->95580 95631 7529e8 48 API calls ___crtGetEnvironmentStringsW 95580->95631 95632 74fda5 60 API calls 2 library calls 95580->95632 95581->95585 95582 701b90 48 API calls 95582->95585 95583->95556 95585->95578 95585->95582 95618 75040f 95585->95618 95634 6fdcae 50 API calls Mailbox 95585->95634 95588 6fbdfa 48 API calls 95587->95588 95589 750582 CharLowerBuffW 95588->95589 95636 731f11 95589->95636 95593 6fd7f7 48 API calls 95594 7505bb 95593->95594 95643 6f69e9 48 API calls ___crtGetEnvironmentStringsW 95594->95643 95596 7505d2 95598 6fb18b 48 API calls 95596->95598 95597 75061a Mailbox 95597->95580 95599 7505de Mailbox 95598->95599 95599->95597 95644 74fda5 60 API calls 2 library calls 95599->95644 95601 74f725 95600->95601 95605 74f77a 95600->95605 95602 70f4ea 48 API calls 95601->95602 95604 74f747 95602->95604 95603 70f4ea 48 API calls 95603->95604 95604->95603 95604->95605 95606 750828 95605->95606 95607 750a53 Mailbox 95606->95607 95613 75084b _strcat _wcscpy __wsetenvp 95606->95613 95607->95568 95608 6fcf93 58 API calls 95608->95613 95609 6fd286 48 API calls 95609->95613 95610 71395c 47 API calls _W_store_winword 95610->95613 95611 6f936c 81 API calls 95611->95613 95613->95607 95613->95608 95613->95609 95613->95610 95613->95611 95647 738035 50 API calls __wsetenvp 95613->95647 95616 70ed2d 95614->95616 95615 70edc5 VirtualProtect 95617 70ed93 95615->95617 95616->95615 95616->95617 95617->95571 95617->95572 95619 750427 95618->95619 95630 750443 95618->95630 95620 75044f 95619->95620 95621 75042e 95619->95621 95622 7504f8 95619->95622 95619->95630 95650 6fcdb9 48 API calls 95620->95650 95648 737c56 50 API calls _strlen 95621->95648 95651 739dc5 103 API calls 95622->95651 95623 75051e 95623->95585 95626 711c9d _free 47 API calls 95626->95623 95628 750438 95649 6fcdb9 48 API calls 95628->95649 95630->95623 95630->95626 95631->95580 95632->95580 95633->95575 95634->95585 95635->95561 95638 731f3b __wsetenvp 95636->95638 95637 731f79 95637->95593 95637->95599 95638->95637 95639 731f6f 95638->95639 95640 731ffa 95638->95640 95639->95637 95645 70d37a 60 API calls 95639->95645 95640->95637 95646 70d37a 60 API calls 95640->95646 95643->95596 95644->95597 95645->95639 95646->95640 95647->95613 95648->95628 95649->95630 95650->95630 95651->95630 95652->95521 95653->95513 95654 7619cb 95659 6f2322 95654->95659 95656 7619d1 95692 710f0a 52 API calls __cinit 95656->95692 95658 7619db 95660 6f2344 95659->95660 95693 6f26df 95660->95693 95665 6fd7f7 48 API calls 95666 6f2384 95665->95666 95667 6fd7f7 48 API calls 95666->95667 95668 6f238e 95667->95668 95669 6fd7f7 48 API calls 95668->95669 95670 6f2398 95669->95670 95671 6fd7f7 48 API calls 95670->95671 95672 6f23de 95671->95672 95673 6fd7f7 48 API calls 95672->95673 95674 6f24c1 95673->95674 95701 6f263f 95674->95701 95678 6f24f1 95679 6fd7f7 48 API calls 95678->95679 95680 6f24fb 95679->95680 95730 6f2745 95680->95730 95682 6f2546 95683 6f2556 GetStdHandle 95682->95683 95684 76501d 95683->95684 95685 6f25b1 95683->95685 95684->95685 95687 765026 95684->95687 95686 6f25b7 CoInitialize 95685->95686 95686->95656 95737 7392d4 53 API calls 95687->95737 95689 76502d 95738 7399f9 CreateThread 95689->95738 95691 765039 CloseHandle 95691->95686 95692->95658 95739 6f2854 95693->95739 95696 6f6a63 48 API calls 95697 6f234a 95696->95697 95698 6f272e 95697->95698 95753 6f27ec 6 API calls 95698->95753 95700 6f237a 95700->95665 95702 6fd7f7 48 API calls 95701->95702 95703 6f264f 95702->95703 95704 6fd7f7 48 API calls 95703->95704 95705 6f2657 95704->95705 95754 6f26a7 95705->95754 95708 6f26a7 48 API calls 95709 6f2667 95708->95709 95710 6fd7f7 48 API calls 95709->95710 95711 6f2672 95710->95711 95712 70f4ea 48 API calls 95711->95712 95713 6f24cb 95712->95713 95714 6f22a4 95713->95714 95715 6f22b2 95714->95715 95716 6fd7f7 48 API calls 95715->95716 95717 6f22bd 95716->95717 95718 6fd7f7 48 API calls 95717->95718 95719 6f22c8 95718->95719 95720 6fd7f7 48 API calls 95719->95720 95721 6f22d3 95720->95721 95722 6fd7f7 48 API calls 95721->95722 95723 6f22de 95722->95723 95724 6f26a7 48 API calls 95723->95724 95725 6f22e9 95724->95725 95726 70f4ea 48 API calls 95725->95726 95727 6f22f0 95726->95727 95728 761fe7 95727->95728 95729 6f22f9 RegisterWindowMessageW 95727->95729 95729->95678 95731 6f2755 95730->95731 95732 765f4d 95730->95732 95733 70f4ea 48 API calls 95731->95733 95759 73c942 50 API calls 95732->95759 95736 6f275d 95733->95736 95735 765f58 95736->95682 95737->95689 95738->95691 95760 7399df 54 API calls 95738->95760 95746 6f2870 95739->95746 95742 6f2870 48 API calls 95743 6f2864 95742->95743 95744 6fd7f7 48 API calls 95743->95744 95745 6f2716 95744->95745 95745->95696 95747 6fd7f7 48 API calls 95746->95747 95748 6f287b 95747->95748 95749 6fd7f7 48 API calls 95748->95749 95750 6f2883 95749->95750 95751 6fd7f7 48 API calls 95750->95751 95752 6f285c 95751->95752 95752->95742 95753->95700 95755 6fd7f7 48 API calls 95754->95755 95756 6f26b0 95755->95756 95757 6fd7f7 48 API calls 95756->95757 95758 6f265f 95757->95758 95758->95708 95759->95735 95761 6fb7b1 95770 6fc62c 95761->95770 95763 6fb7ec 95780 6fba85 48 API calls ___crtGetEnvironmentStringsW 95763->95780 95764 6fb7c2 95764->95763 95778 6fbc74 48 API calls 95764->95778 95767 6fb6b7 Mailbox 95768 6fb7e0 95779 6fba85 48 API calls ___crtGetEnvironmentStringsW 95768->95779 95771 6fbcce 48 API calls 95770->95771 95772 6fc63b 95771->95772 95773 7639fd 95772->95773 95775 6fc799 48 API calls 95772->95775 95776 6fc68b 95772->95776 95781 7326bc 88 API calls 4 library calls 95773->95781 95775->95772 95776->95764 95777 763a0b 95778->95768 95779->95763 95780->95767 95781->95777 95782 6ff030 95783 703b70 335 API calls 95782->95783 95784 6ff03c 95783->95784

                                                                                                                    Executed Functions

                                                                                                                    Function 0071B043 Relevance: 21.5, APIs: 14, Instructions: 537COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 856 71b043-71b080 call 71f8a0 859 71b082-71b084 856->859 860 71b089-71b08b 856->860 861 71b860-71b86c call 71a70c 859->861 862 71b08d-71b0a7 call 717bda call 717c0e call 716e10 860->862 863 71b0ac-71b0d9 860->863 862->861 866 71b0e0-71b0e7 863->866 867 71b0db-71b0de 863->867 868 71b105 866->868 869 71b0e9-71b100 call 717bda call 717c0e call 716e10 866->869 867->866 872 71b10b-71b110 867->872 868->872 902 71b851-71b854 869->902 875 71b112-71b11c call 71f82f 872->875 876 71b11f-71b12d call 723bf2 872->876 875->876 887 71b133-71b145 876->887 888 71b44b-71b45d 876->888 887->888 889 71b14b-71b183 call 717a0d GetConsoleMode 887->889 890 71b463-71b473 888->890 891 71b7b8-71b7d5 WriteFile 888->891 889->888 907 71b189-71b18f 889->907 894 71b479-71b484 890->894 895 71b55a-71b55f 890->895 897 71b7e1-71b7e7 GetLastError 891->897 898 71b7d7-71b7df 891->898 900 71b81b-71b833 894->900 901 71b48a-71b49a 894->901 904 71b663-71b66e 895->904 905 71b565-71b56e 895->905 903 71b7e9 897->903 898->903 909 71b835-71b838 900->909 910 71b83e-71b84e call 717c0e call 717bda 900->910 908 71b4a0-71b4a3 901->908 906 71b85e-71b85f 902->906 912 71b7ef-71b7f1 903->912 904->900 911 71b674 904->911 905->900 913 71b574 905->913 906->861 915 71b191-71b193 907->915 916 71b199-71b1bc GetConsoleCP 907->916 917 71b4a5-71b4be 908->917 918 71b4e9-71b520 WriteFile 908->918 909->910 919 71b83a-71b83c 909->919 910->902 920 71b67e-71b693 911->920 922 71b7f3-71b7f5 912->922 923 71b856-71b85c 912->923 914 71b57e-71b595 913->914 924 71b59b-71b59e 914->924 915->888 915->916 925 71b440-71b446 916->925 926 71b1c2-71b1ca 916->926 927 71b4c0-71b4ca 917->927 928 71b4cb-71b4e7 917->928 918->897 929 71b526-71b538 918->929 919->906 930 71b699-71b69b 920->930 922->900 932 71b7f7-71b7fc 922->932 923->906 935 71b5a0-71b5b6 924->935 936 71b5de-71b627 WriteFile 924->936 925->922 937 71b1d4-71b1d6 926->937 927->928 928->908 928->918 929->912 938 71b53e-71b54f 929->938 939 71b6d8-71b719 WideCharToMultiByte 930->939 940 71b69d-71b6b3 930->940 933 71b812-71b819 call 717bed 932->933 934 71b7fe-71b810 call 717c0e call 717bda 932->934 933->902 934->902 944 71b5b8-71b5ca 935->944 945 71b5cd-71b5dc 935->945 936->897 947 71b62d-71b645 936->947 948 71b36b-71b36e 937->948 949 71b1dc-71b1fe 937->949 938->901 950 71b555 938->950 939->897 943 71b71f-71b721 939->943 951 71b6b5-71b6c4 940->951 952 71b6c7-71b6d6 940->952 955 71b727-71b75a WriteFile 943->955 944->945 945->924 945->936 947->912 957 71b64b-71b658 947->957 960 71b370-71b373 948->960 961 71b375-71b3a2 948->961 958 71b200-71b215 949->958 959 71b217-71b223 call 711688 949->959 950->912 951->952 952->930 952->939 964 71b77a-71b78e GetLastError 955->964 965 71b75c-71b776 955->965 957->914 966 71b65e 957->966 967 71b271-71b283 call 7240f7 958->967 980 71b225-71b239 959->980 981 71b269-71b26b 959->981 960->961 962 71b3a8-71b3ab 960->962 961->962 969 71b3b2-71b3c5 call 725884 962->969 970 71b3ad-71b3b0 962->970 974 71b794-71b796 964->974 965->955 972 71b778 965->972 966->912 983 71b435-71b43b 967->983 984 71b289 967->984 969->897 989 71b3cb-71b3d5 969->989 970->969 976 71b407-71b40a 970->976 972->974 974->903 979 71b798-71b7b0 974->979 976->937 986 71b410 976->986 979->920 985 71b7b6 979->985 987 71b412-71b42d 980->987 988 71b23f-71b254 call 7240f7 980->988 981->967 983->903 990 71b28f-71b2c4 WideCharToMultiByte 984->990 985->912 986->983 987->983 988->983 996 71b25a-71b267 988->996 993 71b3d7-71b3ee call 725884 989->993 994 71b3fb-71b401 989->994 990->983 995 71b2ca-71b2f0 WriteFile 990->995 993->897 1001 71b3f4-71b3f5 993->1001 994->976 995->897 998 71b2f6-71b30e 995->998 996->990 998->983 1000 71b314-71b31b 998->1000 1000->994 1002 71b321-71b34c WriteFile 1000->1002 1001->994 1002->897 1003 71b352-71b359 1002->1003 1003->983 1004 71b35f-71b366 1003->1004 1004->994
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 519838974ae69c675e7c153b1851f7d226341a0b466134b1babdc1f2c8825618
                                                                                                                    • Instruction ID: d495cf5e736eba15209437194b504e009869b39c2e6224367b36df6bcbc46f03
                                                                                                                    • Opcode Fuzzy Hash: 519838974ae69c675e7c153b1851f7d226341a0b466134b1babdc1f2c8825618
                                                                                                                    • Instruction Fuzzy Hash: DD325E75A022288FDB248F58DC856E9B7B5FF46310F5841D9E40AE7A91D7389EC0CF92
                                                                                                                    Function 006F3D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151windowCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,006F3AA3,?), ref: 006F3D45
                                                                                                                    • IsDebuggerPresent.KERNEL32(?,?,?,?,006F3AA3,?), ref: 006F3D57
                                                                                                                    • GetFullPathNameW.KERNEL32(00007FFF,?,?,007B1148,007B1130,?,?,?,?,006F3AA3,?), ref: 006F3DC8
                                                                                                                      • Part of subcall function 006F6430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,006F3DEE,007B1148,?,?,?,?,?,006F3AA3,?), ref: 006F6471
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,006F3AA3,?), ref: 006F3E48
                                                                                                                    • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,007A28F4,00000010), ref: 00761CCE
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?,007B1148,?,?,?,?,?,006F3AA3,?), ref: 00761D06
                                                                                                                    • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,0078DAB4,007B1148,?,?,?,?,?,006F3AA3,?), ref: 00761D89
                                                                                                                    • ShellExecuteW.SHELL32(00000000,?,?,?,?,006F3AA3), ref: 00761D90
                                                                                                                      • Part of subcall function 006F3E6E: GetSysColorBrush.USER32(0000000F), ref: 006F3E79
                                                                                                                      • Part of subcall function 006F3E6E: LoadCursorW.USER32(00000000,00007F00), ref: 006F3E88
                                                                                                                      • Part of subcall function 006F3E6E: LoadIconW.USER32(00000063), ref: 006F3E9E
                                                                                                                      • Part of subcall function 006F3E6E: LoadIconW.USER32(000000A4), ref: 006F3EB0
                                                                                                                      • Part of subcall function 006F3E6E: LoadIconW.USER32(000000A2), ref: 006F3EC2
                                                                                                                      • Part of subcall function 006F3E6E: RegisterClassExW.USER32(?), ref: 006F3F30
                                                                                                                      • Part of subcall function 006F36B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 006F36E6
                                                                                                                      • Part of subcall function 006F36B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 006F3707
                                                                                                                      • Part of subcall function 006F36B8: ShowWindow.USER32(00000000,?,?,?,?,006F3AA3,?), ref: 006F371B
                                                                                                                      • Part of subcall function 006F36B8: ShowWindow.USER32(00000000,?,?,?,?,006F3AA3,?), ref: 006F3724
                                                                                                                      • Part of subcall function 006F4FFC: _memset.LIBCMT ref: 006F5022
                                                                                                                      • Part of subcall function 006F4FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 006F50CB
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
                                                                                                                    • String ID: ()z$This is a third-party compiled AutoIt script.$runas
                                                                                                                    • API String ID: 438480954-820707378
                                                                                                                    • Opcode ID: bf9cebb0115b90d668ac0cfcc553174818a1ecd28a18bde4ae95f1a9ea85a12a
                                                                                                                    • Instruction ID: e15cfd85e1eb1341ceb674dffec2fcd322d32703e3323c3a267ebbe49801cefc
                                                                                                                    • Opcode Fuzzy Hash: bf9cebb0115b90d668ac0cfcc553174818a1ecd28a18bde4ae95f1a9ea85a12a
                                                                                                                    • Instruction Fuzzy Hash: 4D510C31A0424CBACB11BBB8DC55FFE7B7B9F05740F808269F70262292DA7C5A45CB25
                                                                                                                    Function 0070DDC0 Relevance: 10.7, APIs: 7, Instructions: 175COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 1288 70ddc0-70de4f call 6fd7f7 GetVersionExW call 6f6a63 call 70dfb4 call 6f6571 1297 70de55-70de56 1288->1297 1298 7624c8-7624cb 1288->1298 1299 70de92-70dea2 call 70df77 1297->1299 1300 70de58-70de63 1297->1300 1301 7624e4-7624e8 1298->1301 1302 7624cd 1298->1302 1319 70dea4-70dec1 GetCurrentProcess call 70df5f 1299->1319 1320 70dec7-70dee1 1299->1320 1305 76244e-762454 1300->1305 1306 70de69-70de6b 1300->1306 1303 7624d3-7624dc 1301->1303 1304 7624ea-7624f3 1301->1304 1308 7624d0 1302->1308 1303->1301 1304->1308 1311 7624f5-7624f8 1304->1311 1309 762456-762459 1305->1309 1310 76245e-762464 1305->1310 1312 70de71-70de74 1306->1312 1313 762469-762475 1306->1313 1308->1303 1309->1299 1310->1299 1311->1303 1317 762495-762498 1312->1317 1318 70de7a-70de89 1312->1318 1315 762477-76247a 1313->1315 1316 76247f-762485 1313->1316 1315->1299 1316->1299 1317->1299 1323 76249e-7624b3 1317->1323 1324 76248a-762490 1318->1324 1325 70de8f 1318->1325 1319->1320 1339 70dec3 1319->1339 1321 70df31-70df3b GetSystemInfo 1320->1321 1322 70dee3-70def7 call 70e00c 1320->1322 1327 70df0e-70df1a 1321->1327 1336 70df29-70df2f GetSystemInfo 1322->1336 1337 70def9-70df01 call 70dff4 GetNativeSystemInfo 1322->1337 1329 7624b5-7624b8 1323->1329 1330 7624bd-7624c3 1323->1330 1324->1299 1325->1299 1333 70df21-70df26 1327->1333 1334 70df1c-70df1f FreeLibrary 1327->1334 1329->1299 1330->1299 1334->1333 1338 70df03-70df07 1336->1338 1337->1338 1338->1327 1342 70df09-70df0c FreeLibrary 1338->1342 1339->1320 1342->1327
                                                                                                                    APIs
                                                                                                                    • GetVersionExW.KERNEL32(?), ref: 0070DDEC
                                                                                                                    • GetCurrentProcess.KERNEL32(00000000,0078DC38,?,?), ref: 0070DEAC
                                                                                                                    • GetNativeSystemInfo.KERNELBASE(?,0078DC38,?,?), ref: 0070DF01
                                                                                                                    • FreeLibrary.KERNEL32(00000000,?,?), ref: 0070DF0C
                                                                                                                    • FreeLibrary.KERNEL32(00000000,?,?), ref: 0070DF1F
                                                                                                                    • GetSystemInfo.KERNEL32(?,0078DC38,?,?), ref: 0070DF29
                                                                                                                    • GetSystemInfo.KERNEL32(?,0078DC38,?,?), ref: 0070DF35
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3851250370-0
                                                                                                                    • Opcode ID: 8def42e4ac1ef5f3da74ecd635ead83514d630b8b54bbd8947605c5d479fe399
                                                                                                                    • Instruction ID: 1a04e25816ab60767f3f4486e697c0fe7153a9f94e979a7f895fc15baa6d5abd
                                                                                                                    • Opcode Fuzzy Hash: 8def42e4ac1ef5f3da74ecd635ead83514d630b8b54bbd8947605c5d479fe399
                                                                                                                    • Instruction Fuzzy Hash: EE61947180A3C4DFCF25CFA894C15E9BFB56F29300B198AD9D8459F247C628CD49CB69
                                                                                                                    Function 006F406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 1360 6f406b-6f4083 CreateStreamOnHGlobal 1361 6f4085-6f409c FindResourceExW 1360->1361 1362 6f40a3-6f40a6 1360->1362 1363 764f16-764f25 LoadResource 1361->1363 1364 6f40a2 1361->1364 1363->1364 1365 764f2b-764f39 SizeofResource 1363->1365 1364->1362 1365->1364 1366 764f3f-764f4a LockResource 1365->1366 1366->1364 1367 764f50-764f6e 1366->1367 1367->1364
                                                                                                                    APIs
                                                                                                                    • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,006F449E,?,?,00000000,00000001), ref: 006F407B
                                                                                                                    • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,006F449E,?,?,00000000,00000001), ref: 006F4092
                                                                                                                    • LoadResource.KERNEL32(?,00000000,?,?,006F449E,?,?,00000000,00000001,?,?,?,?,?,?,006F41FB), ref: 00764F1A
                                                                                                                    • SizeofResource.KERNEL32(?,00000000,?,?,006F449E,?,?,00000000,00000001,?,?,?,?,?,?,006F41FB), ref: 00764F2F
                                                                                                                    • LockResource.KERNEL32(006F449E,?,?,006F449E,?,?,00000000,00000001,?,?,?,?,?,?,006F41FB,00000000), ref: 00764F42
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                                                                    • String ID: SCRIPT
                                                                                                                    • API String ID: 3051347437-3967369404
                                                                                                                    • Opcode ID: 31b8cf95c1ef9f377b48063d9029208bccc231e3f04e2bd09f872ec0b4a622df
                                                                                                                    • Instruction ID: 4b97d629fc1f184478a74e712bfdd6b80ce09815beb4bf365bf4a62c10beb014
                                                                                                                    • Opcode Fuzzy Hash: 31b8cf95c1ef9f377b48063d9029208bccc231e3f04e2bd09f872ec0b4a622df
                                                                                                                    • Instruction Fuzzy Hash: 23115A70200705AFE7318B65EC48F677BBAEFC5B51F10812CF606966A0DE75EC419A20
                                                                                                                    Function 00703B70 Relevance: 5.9, Strings: 4, Instructions: 903COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Exception@8Throwstd::exception::exception
                                                                                                                    • String ID: @$ {$ {$ {
                                                                                                                    • API String ID: 3728558374-2436217950
                                                                                                                    • Opcode ID: 696a8e6afad813dd189942dbbfd740a559f706eb0fe18cf8f383c7460d7a17b4
                                                                                                                    • Instruction ID: 3ddf6406f5ef9b415c3f5d2b0a221f314fb973b963f7522c81ac27501774ac80
                                                                                                                    • Opcode Fuzzy Hash: 696a8e6afad813dd189942dbbfd740a559f706eb0fe18cf8f383c7460d7a17b4
                                                                                                                    • Instruction Fuzzy Hash: 6F72AD70E04209DFDB14DF94C485AAEB7FAFF48344F14825AED06AB291D738AE45CB91
                                                                                                                    Function 00736CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetFileAttributesW.KERNELBASE(?,00762F49), ref: 00736CB9
                                                                                                                    • FindFirstFileW.KERNELBASE(?,?), ref: 00736CCA
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 00736CDA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: FileFind$AttributesCloseFirst
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 48322524-0
                                                                                                                    • Opcode ID: 0ef2684e321e8d9a2de8220f5efee6f46c84d32ad4f596090f3b2b67110f5bc1
                                                                                                                    • Instruction ID: 32c67bd01bfbb69bd3a0716cd9af101cef155af6f23f33e1d260dbff55f6dbc7
                                                                                                                    • Opcode Fuzzy Hash: 0ef2684e321e8d9a2de8220f5efee6f46c84d32ad4f596090f3b2b67110f5bc1
                                                                                                                    • Instruction Fuzzy Hash: FAE0D8358114146792206738EC0D8E9777CDE0537AF508715F575C11D0E778ED4095F9
                                                                                                                    Function 00703200 Relevance: 2.2, Strings: 1, Instructions: 986COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: BuffCharUpper
                                                                                                                    • String ID: {
                                                                                                                    • API String ID: 3964851224-3059882122
                                                                                                                    • Opcode ID: df46d4eea919531433a0151e098bc766d848d69e8d45e19014b302d3b369b735
                                                                                                                    • Instruction ID: 8aa8c211dfdf2f5cff2691edf5e00cbcb5c23e8ce5df0169d0ee7cbb61cb69e5
                                                                                                                    • Opcode Fuzzy Hash: df46d4eea919531433a0151e098bc766d848d69e8d45e19014b302d3b369b735
                                                                                                                    • Instruction Fuzzy Hash: 9D926A70608241DFD724DF18C484B6AB7E9BF84308F148A5DF98A8B3A2D779ED45CB52
                                                                                                                    Function 006FE8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006FE959
                                                                                                                    • timeGetTime.WINMM ref: 006FEBFA
                                                                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006FED2E
                                                                                                                    • TranslateMessage.USER32(?), ref: 006FED3F
                                                                                                                    • DispatchMessageW.USER32(?), ref: 006FED4A
                                                                                                                    • LockWindowUpdate.USER32(00000000), ref: 006FED79
                                                                                                                    • DestroyWindow.USER32 ref: 006FED85
                                                                                                                    • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 006FED9F
                                                                                                                    • Sleep.KERNEL32(0000000A), ref: 00765270
                                                                                                                    • TranslateMessage.USER32(?), ref: 007659F7
                                                                                                                    • DispatchMessageW.USER32(?), ref: 00765A05
                                                                                                                    • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00765A19
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
                                                                                                                    • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
                                                                                                                    • API String ID: 2641332412-570651680
                                                                                                                    • Opcode ID: 4c799045740e6568c9d086fe7f0de087083981157c44cf9b1c0e95a3647e84ab
                                                                                                                    • Instruction ID: b47f731bde6ee473a7bed69784f776484a25bbe0f97fb9e993687133a8a06074
                                                                                                                    • Opcode Fuzzy Hash: 4c799045740e6568c9d086fe7f0de087083981157c44cf9b1c0e95a3647e84ab
                                                                                                                    • Instruction Fuzzy Hash: 6162F870504348DFDB24DF24C899BBA7BE6BF44304F04496DFA4A8B2A2DB79D845CB52
                                                                                                                    Function 00725C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • ___createFile.LIBCMT ref: 00725EC3
                                                                                                                    • ___createFile.LIBCMT ref: 00725F04
                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00725F2D
                                                                                                                    • __dosmaperr.LIBCMT ref: 00725F34
                                                                                                                    • GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 00725F47
                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00725F6A
                                                                                                                    • __dosmaperr.LIBCMT ref: 00725F73
                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00725F7C
                                                                                                                    • __set_osfhnd.LIBCMT ref: 00725FAC
                                                                                                                    • __lseeki64_nolock.LIBCMT ref: 00726016
                                                                                                                    • __close_nolock.LIBCMT ref: 0072603C
                                                                                                                    • __chsize_nolock.LIBCMT ref: 0072606C
                                                                                                                    • __lseeki64_nolock.LIBCMT ref: 0072607E
                                                                                                                    • __lseeki64_nolock.LIBCMT ref: 00726176
                                                                                                                    • __lseeki64_nolock.LIBCMT ref: 0072618B
                                                                                                                    • __close_nolock.LIBCMT ref: 007261EB
                                                                                                                      • Part of subcall function 0071EA9C: CloseHandle.KERNELBASE(00000000,0079EEF4,00000000,?,00726041,0079EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0071EAEC
                                                                                                                      • Part of subcall function 0071EA9C: GetLastError.KERNEL32(?,00726041,0079EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0071EAF6
                                                                                                                      • Part of subcall function 0071EA9C: __free_osfhnd.LIBCMT ref: 0071EB03
                                                                                                                      • Part of subcall function 0071EA9C: __dosmaperr.LIBCMT ref: 0071EB25
                                                                                                                      • Part of subcall function 00717C0E: __getptd_noexit.LIBCMT ref: 00717C0E
                                                                                                                    • __lseeki64_nolock.LIBCMT ref: 0072620D
                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00726342
                                                                                                                    • ___createFile.LIBCMT ref: 00726361
                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0072636E
                                                                                                                    • __dosmaperr.LIBCMT ref: 00726375
                                                                                                                    • __free_osfhnd.LIBCMT ref: 00726395
                                                                                                                    • __invoke_watson.LIBCMT ref: 007263C3
                                                                                                                    • __wsopen_helper.LIBCMT ref: 007263DD
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
                                                                                                                    • String ID: @
                                                                                                                    • API String ID: 3896587723-2766056989
                                                                                                                    • Opcode ID: 2358ba54b970bfaf857d6b0e0fddf66b882d4d6ed1bfd40981eb7410eeaa1dc9
                                                                                                                    • Instruction ID: c67aae5d35ed152ae309a1d3509fc26d75bc6b34eab2a15f9e8ac0678ef95b4a
                                                                                                                    • Opcode Fuzzy Hash: 2358ba54b970bfaf857d6b0e0fddf66b882d4d6ed1bfd40981eb7410eeaa1dc9
                                                                                                                    • Instruction Fuzzy Hash: F5222771A006299BEB299F68EC85BFD7B71FF04314F24422AE9119B2D1C73D8D90D791
                                                                                                                    Function 0073FA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • _wcscpy.LIBCMT ref: 0073FA96
                                                                                                                    • _wcschr.LIBCMT ref: 0073FAA4
                                                                                                                    • _wcscpy.LIBCMT ref: 0073FABB
                                                                                                                    • _wcscat.LIBCMT ref: 0073FACA
                                                                                                                    • _wcscat.LIBCMT ref: 0073FAE8
                                                                                                                    • _wcscpy.LIBCMT ref: 0073FB09
                                                                                                                    • __wsplitpath.LIBCMT ref: 0073FBE6
                                                                                                                    • _wcscpy.LIBCMT ref: 0073FC0B
                                                                                                                    • _wcscpy.LIBCMT ref: 0073FC1D
                                                                                                                    • _wcscpy.LIBCMT ref: 0073FC32
                                                                                                                    • _wcscat.LIBCMT ref: 0073FC47
                                                                                                                    • _wcscat.LIBCMT ref: 0073FC59
                                                                                                                    • _wcscat.LIBCMT ref: 0073FC6E
                                                                                                                      • Part of subcall function 0073BFA4: _wcscmp.LIBCMT ref: 0073C03E
                                                                                                                      • Part of subcall function 0073BFA4: __wsplitpath.LIBCMT ref: 0073C083
                                                                                                                      • Part of subcall function 0073BFA4: _wcscpy.LIBCMT ref: 0073C096
                                                                                                                      • Part of subcall function 0073BFA4: _wcscat.LIBCMT ref: 0073C0A9
                                                                                                                      • Part of subcall function 0073BFA4: __wsplitpath.LIBCMT ref: 0073C0CE
                                                                                                                      • Part of subcall function 0073BFA4: _wcscat.LIBCMT ref: 0073C0E4
                                                                                                                      • Part of subcall function 0073BFA4: _wcscat.LIBCMT ref: 0073C0F7
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
                                                                                                                    • String ID: >>>AUTOIT SCRIPT<<<$t2z
                                                                                                                    • API String ID: 2955681530-1018744523
                                                                                                                    • Opcode ID: 180d657c75d822eaaf49ea856cb1df1b7d1553075f0e2f3ffa6fe27974d69400
                                                                                                                    • Instruction ID: f4ddbe20fb9b30bcb09018fc7a1b1e7c4875bcc0139f0b9d2826a678cef0b58d
                                                                                                                    • Opcode Fuzzy Hash: 180d657c75d822eaaf49ea856cb1df1b7d1553075f0e2f3ffa6fe27974d69400
                                                                                                                    • Instruction Fuzzy Hash: FA91A372504605EFDB10EF64C855F9BB3E9BF84310F00492DF98997292DB38EA44CBA5
                                                                                                                    Function 0071EE0E Relevance: 26.2, APIs: 17, Instructions: 664COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __getptd_noexit
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3074181302-0
                                                                                                                    • Opcode ID: 46f4d6678fe57edfdb12ef20c1ce2336f05f83505d12e6386d1b634600219213
                                                                                                                    • Instruction ID: 5a738c71434ed5ac54b209852b0a42fcd0691f08111ab4abdf58e4b2554e0ca9
                                                                                                                    • Opcode Fuzzy Hash: 46f4d6678fe57edfdb12ef20c1ce2336f05f83505d12e6386d1b634600219213
                                                                                                                    • Instruction Fuzzy Hash: D6321670A04285DFEB318F6CD840BED7BB1AF45314F24816AE8559B2D2D73C99C2CBA1
                                                                                                                    Function 006F3F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 006F3F86
                                                                                                                    • RegisterClassExW.USER32(00000030), ref: 006F3FB0
                                                                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006F3FC1
                                                                                                                    • InitCommonControlsEx.COMCTL32(?), ref: 006F3FDE
                                                                                                                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006F3FEE
                                                                                                                    • LoadIconW.USER32(000000A9), ref: 006F4004
                                                                                                                    • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006F4013
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                                    • API String ID: 2914291525-1005189915
                                                                                                                    • Opcode ID: 73a87bb1bf8a28c52299f50732af2cd5b299726e6aa3d3e149ac14ddfbaa871e
                                                                                                                    • Instruction ID: 6a15fabe287d9245c1de1f0f84405ffd19ce0b1aff4ab3a48c72b4ce41c4bc49
                                                                                                                    • Opcode Fuzzy Hash: 73a87bb1bf8a28c52299f50732af2cd5b299726e6aa3d3e149ac14ddfbaa871e
                                                                                                                    • Instruction Fuzzy Hash: 8221F7B5D00308AFDB10DFA4EC99BCDBBB4FB08744F50821AF515A62A0D7B90984CF99
                                                                                                                    Function 0073BFA4 Relevance: 18.3, APIs: 12, Instructions: 316fileCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 1073 73bfa4-73c054 call 71f8a0 call 70f4ea call 6f47b7 call 73bdb4 call 6f4517 call 7115e3 1086 73c107-73c10e call 73c56d 1073->1086 1087 73c05a-73c061 call 73c56d 1073->1087 1092 73c110-73c112 1086->1092 1093 73c117 1086->1093 1087->1092 1094 73c067-73c105 call 711dfc call 710d23 call 710cf4 call 711dfc call 710cf4 * 2 1087->1094 1095 73c367-73c368 1092->1095 1097 73c11a-73c1d6 call 6f44ed * 8 call 73c71a call 713499 1093->1097 1094->1097 1100 73c385-73c393 call 6f47e2 1095->1100 1132 73c1d8-73c1da 1097->1132 1133 73c1df-73c1fa call 73bdf8 1097->1133 1132->1095 1136 73c200-73c208 1133->1136 1137 73c28c-73c298 call 7135e4 1133->1137 1138 73c210 1136->1138 1139 73c20a-73c20e 1136->1139 1144 73c29a-73c2a9 DeleteFileW 1137->1144 1145 73c2ae-73c2b2 1137->1145 1141 73c215-73c233 call 6f44ed 1138->1141 1139->1141 1149 73c235-73c23b 1141->1149 1150 73c25d-73c273 call 73b791 call 712aae 1141->1150 1144->1095 1147 73c342-73c356 CopyFileW 1145->1147 1148 73c2b8-73c32f call 73c81d call 73c845 call 73b965 1145->1148 1152 73c36a-73c380 DeleteFileW call 73c6d9 1147->1152 1153 73c358-73c365 DeleteFileW 1147->1153 1148->1152 1169 73c331-73c340 DeleteFileW 1148->1169 1154 73c23d-73c250 call 73bf2e 1149->1154 1166 73c278-73c283 1150->1166 1152->1100 1153->1095 1164 73c252-73c25b 1154->1164 1164->1150 1166->1136 1168 73c289 1166->1168 1168->1137 1169->1095
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0073BDB4: __time64.LIBCMT ref: 0073BDBE
                                                                                                                      • Part of subcall function 006F4517: _fseek.LIBCMT ref: 006F452F
                                                                                                                    • __wsplitpath.LIBCMT ref: 0073C083
                                                                                                                      • Part of subcall function 00711DFC: __wsplitpath_helper.LIBCMT ref: 00711E3C
                                                                                                                    • _wcscpy.LIBCMT ref: 0073C096
                                                                                                                    • _wcscat.LIBCMT ref: 0073C0A9
                                                                                                                    • __wsplitpath.LIBCMT ref: 0073C0CE
                                                                                                                    • _wcscat.LIBCMT ref: 0073C0E4
                                                                                                                    • _wcscat.LIBCMT ref: 0073C0F7
                                                                                                                    • _wcscmp.LIBCMT ref: 0073C03E
                                                                                                                      • Part of subcall function 0073C56D: _wcscmp.LIBCMT ref: 0073C65D
                                                                                                                      • Part of subcall function 0073C56D: _wcscmp.LIBCMT ref: 0073C670
                                                                                                                    • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0073C2A1
                                                                                                                    • DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0073C338
                                                                                                                    • CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0073C34E
                                                                                                                    • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0073C35F
                                                                                                                    • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0073C371
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2378138488-0
                                                                                                                    • Opcode ID: 919254fa412f5443a14fdd4be15b4a967ba95b2705e4db7519b828a8f9d82a39
                                                                                                                    • Instruction ID: 01711bbc34d2e04aa2853021c509e6a95f287a6f38a54c701ad87c08b9bdc42c
                                                                                                                    • Opcode Fuzzy Hash: 919254fa412f5443a14fdd4be15b4a967ba95b2705e4db7519b828a8f9d82a39
                                                                                                                    • Instruction Fuzzy Hash: 1DC11CB1A00219AFDF11DF95CC85EEEB7B9EF49310F0040AAF609F6152DB749A848F65
                                                                                                                    Function 006F3742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 1170 6f3742-6f3762 1172 6f3764-6f3767 1170->1172 1173 6f37c2-6f37c4 1170->1173 1175 6f3769-6f3770 1172->1175 1176 6f37c8 1172->1176 1173->1172 1174 6f37c6 1173->1174 1177 6f37ab-6f37b3 DefWindowProcW 1174->1177 1180 6f382c-6f3834 PostQuitMessage 1175->1180 1181 6f3776-6f377b 1175->1181 1178 6f37ce-6f37d1 1176->1178 1179 761e00-761e2e call 6f2ff6 call 70e312 1176->1179 1182 6f37b9-6f37bf 1177->1182 1183 6f37f6-6f381d SetTimer RegisterWindowMessageW 1178->1183 1184 6f37d3-6f37d4 1178->1184 1217 761e33-761e3a 1179->1217 1188 6f37f2-6f37f4 1180->1188 1186 761e88-761e9c call 734ddd 1181->1186 1187 6f3781-6f3783 1181->1187 1183->1188 1192 6f381f-6f382a CreatePopupMenu 1183->1192 1189 761da3-761da6 1184->1189 1190 6f37da-6f37ed KillTimer call 6f3847 call 6f390f 1184->1190 1186->1188 1212 761ea2 1186->1212 1193 6f3789-6f378e 1187->1193 1194 6f3836-6f3840 call 70eb83 1187->1194 1188->1182 1196 761ddc-761dfb MoveWindow 1189->1196 1197 761da8-761daa 1189->1197 1190->1188 1192->1188 1200 761e6d-761e74 1193->1200 1201 6f3794-6f3799 1193->1201 1204 6f3845 1194->1204 1196->1188 1205 761dac-761daf 1197->1205 1206 761dcb-761dd7 SetFocus 1197->1206 1200->1177 1208 761e7a-761e83 call 72a5f3 1200->1208 1210 6f379f-6f37a5 1201->1210 1211 761e58-761e68 call 7355bd 1201->1211 1204->1188 1205->1210 1213 761db5-761dc6 call 6f2ff6 1205->1213 1206->1188 1208->1177 1210->1177 1210->1217 1211->1188 1212->1177 1213->1188 1217->1177 1218 761e40-761e53 call 6f3847 call 6f4ffc 1217->1218 1218->1177
                                                                                                                    APIs
                                                                                                                    • DefWindowProcW.USER32(?,?,?,?), ref: 006F37B3
                                                                                                                    • KillTimer.USER32(?,00000001), ref: 006F37DD
                                                                                                                    • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006F3800
                                                                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006F380B
                                                                                                                    • CreatePopupMenu.USER32 ref: 006F381F
                                                                                                                    • PostQuitMessage.USER32(00000000), ref: 006F382E
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                                                                    • String ID: TaskbarCreated
                                                                                                                    • API String ID: 129472671-2362178303
                                                                                                                    • Opcode ID: b65f3ca5d3e94c62ae7efd6d4ede00a841958f32e397db44852bb6fdcdf58b3c
                                                                                                                    • Instruction ID: 155437a98c95fcdfc6e53c731bcd63c8fa373808776f5bb552a7695ec73e38be
                                                                                                                    • Opcode Fuzzy Hash: b65f3ca5d3e94c62ae7efd6d4ede00a841958f32e397db44852bb6fdcdf58b3c
                                                                                                                    • Instruction Fuzzy Hash: 754126F120016DA7DB247B28DC5EFBA366BFB00341F944229FB02D23A1CA6D9D41976D
                                                                                                                    Function 006F3E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66windowregistryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    APIs
                                                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 006F3E79
                                                                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 006F3E88
                                                                                                                    • LoadIconW.USER32(00000063), ref: 006F3E9E
                                                                                                                    • LoadIconW.USER32(000000A4), ref: 006F3EB0
                                                                                                                    • LoadIconW.USER32(000000A2), ref: 006F3EC2
                                                                                                                      • Part of subcall function 006F4024: LoadImageW.USER32(006F0000,00000063,00000001,00000010,00000010,00000000), ref: 006F4048
                                                                                                                    • RegisterClassExW.USER32(?), ref: 006F3F30
                                                                                                                      • Part of subcall function 006F3F53: GetSysColorBrush.USER32(0000000F), ref: 006F3F86
                                                                                                                      • Part of subcall function 006F3F53: RegisterClassExW.USER32(00000030), ref: 006F3FB0
                                                                                                                      • Part of subcall function 006F3F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006F3FC1
                                                                                                                      • Part of subcall function 006F3F53: InitCommonControlsEx.COMCTL32(?), ref: 006F3FDE
                                                                                                                      • Part of subcall function 006F3F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006F3FEE
                                                                                                                      • Part of subcall function 006F3F53: LoadIconW.USER32(000000A9), ref: 006F4004
                                                                                                                      • Part of subcall function 006F3F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006F4013
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                    • String ID: #$0$AutoIt v3
                                                                                                                    • API String ID: 423443420-4155596026
                                                                                                                    • Opcode ID: 18163d2e2d1f760128f2ce5e6229236a45154bc9ca5984d8101b4df1f9778a6a
                                                                                                                    • Instruction ID: bea35d12653a78116d487ee7aa6b25e32838b71933f16fd8b211e397e728abf4
                                                                                                                    • Opcode Fuzzy Hash: 18163d2e2d1f760128f2ce5e6229236a45154bc9ca5984d8101b4df1f9778a6a
                                                                                                                    • Instruction Fuzzy Hash: 272153B0D0430CABCB14DFA9EC55F9ABFF5FB48310F90C21AE204A22A0D77946508F99
                                                                                                                    Function 015B3858 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 1234 15b3858-15b3906 call 15b1258 1237 15b390d-15b3933 call 15b4768 CreateFileW 1234->1237 1240 15b393a-15b394a 1237->1240 1241 15b3935 1237->1241 1249 15b394c 1240->1249 1250 15b3951-15b396b VirtualAlloc 1240->1250 1242 15b3a85-15b3a89 1241->1242 1243 15b3acb-15b3ace 1242->1243 1244 15b3a8b-15b3a8f 1242->1244 1246 15b3ad1-15b3ad8 1243->1246 1247 15b3a9b-15b3a9f 1244->1247 1248 15b3a91-15b3a94 1244->1248 1253 15b3ada-15b3ae5 1246->1253 1254 15b3b2d-15b3b42 1246->1254 1255 15b3aaf-15b3ab3 1247->1255 1256 15b3aa1-15b3aab 1247->1256 1248->1247 1249->1242 1251 15b396d 1250->1251 1252 15b3972-15b3989 ReadFile 1250->1252 1251->1242 1257 15b398b 1252->1257 1258 15b3990-15b39d0 VirtualAlloc 1252->1258 1259 15b3ae9-15b3af5 1253->1259 1260 15b3ae7 1253->1260 1261 15b3b52-15b3b5a 1254->1261 1262 15b3b44-15b3b4f VirtualFree 1254->1262 1263 15b3ac3 1255->1263 1264 15b3ab5-15b3abf 1255->1264 1256->1255 1257->1242 1265 15b39d2 1258->1265 1266 15b39d7-15b39f2 call 15b49b8 1258->1266 1267 15b3b09-15b3b15 1259->1267 1268 15b3af7-15b3b07 1259->1268 1260->1254 1262->1261 1263->1243 1264->1263 1265->1242 1274 15b39fd-15b3a07 1266->1274 1271 15b3b22-15b3b28 1267->1271 1272 15b3b17-15b3b20 1267->1272 1270 15b3b2b 1268->1270 1270->1246 1271->1270 1272->1270 1275 15b3a3a-15b3a4e call 15b47c8 1274->1275 1276 15b3a09-15b3a38 call 15b49b8 1274->1276 1281 15b3a52-15b3a56 1275->1281 1282 15b3a50 1275->1282 1276->1274 1284 15b3a58-15b3a5c CloseHandle 1281->1284 1285 15b3a62-15b3a66 1281->1285 1282->1242 1284->1285 1286 15b3a68-15b3a73 VirtualFree 1285->1286 1287 15b3a76-15b3a7f 1285->1287 1286->1287 1287->1237 1287->1242
                                                                                                                    APIs
                                                                                                                    • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 015B3929
                                                                                                                    • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 015B3B4F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1320267375.00000000015B1000.00000040.00000020.00020000.00000000.sdmp, Offset: 015B1000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_15b1000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateFileFreeVirtual
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 204039940-0
                                                                                                                    • Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                                                                    • Instruction ID: 3f80508fd86c3948375341d1dea2224ba979610b989634b20e0452dcae0551be
                                                                                                                    • Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                                                                    • Instruction Fuzzy Hash: 1BA10674E00209EBDF54CFA8C898BEEBBB5FF48304F208559E611BB281D7759A85CB54
                                                                                                                    Function 006F49FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73registryCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 1343 6f49fb-6f4a25 call 6fbcce RegOpenKeyExW 1346 6f4a2b-6f4a2f 1343->1346 1347 7641cc-7641e3 RegQueryValueExW 1343->1347 1348 764246-76424f RegCloseKey 1347->1348 1349 7641e5-764222 call 70f4ea call 6f47b7 RegQueryValueExW 1347->1349 1354 764224-76423b call 6f6a63 1349->1354 1355 76423d-764245 call 6f47e2 1349->1355 1354->1355 1355->1348
                                                                                                                    APIs
                                                                                                                    • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 006F4A1D
                                                                                                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 007641DB
                                                                                                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0076421A
                                                                                                                    • RegCloseKey.ADVAPI32(?), ref: 00764249
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: QueryValue$CloseOpen
                                                                                                                    • String ID: Include$Software\AutoIt v3\AutoIt
                                                                                                                    • API String ID: 1586453840-614718249
                                                                                                                    • Opcode ID: ccf1e998859993e9c5b9e7dc003961c4de75b2ad8ffd47e56dcae266f4471c77
                                                                                                                    • Instruction ID: 8324d2428b4a1798feed11f593a12ec59b8cbc628050166256314b8e680e2f09
                                                                                                                    • Opcode Fuzzy Hash: ccf1e998859993e9c5b9e7dc003961c4de75b2ad8ffd47e56dcae266f4471c77
                                                                                                                    • Instruction Fuzzy Hash: 35116DB160010CBEEB14ABA4CD86DBF7BBCEF04344F105058F506E2191EA74AE41DB64
                                                                                                                    Function 006F36B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 1370 6f36b8-6f3728 CreateWindowExW * 2 ShowWindow * 2
                                                                                                                    APIs
                                                                                                                    • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 006F36E6
                                                                                                                    • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 006F3707
                                                                                                                    • ShowWindow.USER32(00000000,?,?,?,?,006F3AA3,?), ref: 006F371B
                                                                                                                    • ShowWindow.USER32(00000000,?,?,?,?,006F3AA3,?), ref: 006F3724
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$CreateShow
                                                                                                                    • String ID: AutoIt v3$edit
                                                                                                                    • API String ID: 1584632944-3779509399
                                                                                                                    • Opcode ID: 91f8a1da88e201079e192fcf0ff7b83f5c0d7f1fe5197304bddc33d995351385
                                                                                                                    • Instruction ID: 1630e5b71523e2a5f21b62281b8ff97fc30441eb05563b9399c82c0898be3815
                                                                                                                    • Opcode Fuzzy Hash: 91f8a1da88e201079e192fcf0ff7b83f5c0d7f1fe5197304bddc33d995351385
                                                                                                                    • Instruction Fuzzy Hash: 6CF03A719442D47AE7306757AC18F672E7DD7C6F60FA0C11ABA08A21A0C1690C81CAB5
                                                                                                                    Function 00717B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 1371 717b47-717b53 call 71123a call 717e23 1376 717b55-717b5c call 717bbd 1371->1376 1377 717b5d-717b70 call 717e6d 1371->1377 1377->1376 1382 717b72-717b7a call 716986 1377->1382 1384 717b7f-717b85 1382->1384 1385 717bb4-717bbc call 717bbd 1384->1385 1386 717b87-717b97 call 717ec9 1384->1386 1386->1385 1391 717b99-717bb3 call 717a94 GetCurrentThreadId 1386->1391
                                                                                                                    APIs
                                                                                                                    • __init_pointers.LIBCMT ref: 00717B47
                                                                                                                      • Part of subcall function 0071123A: __initp_misc_winsig.LIBCMT ref: 0071125E
                                                                                                                      • Part of subcall function 0071123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00717F51
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00717F65
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00717F78
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00717F8B
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00717F9E
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00717FB1
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00717FC4
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00717FD7
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00717FEA
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00717FFD
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00718010
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00718023
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00718036
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00718049
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0071805C
                                                                                                                      • Part of subcall function 0071123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 0071806F
                                                                                                                    • __mtinitlocks.LIBCMT ref: 00717B4C
                                                                                                                      • Part of subcall function 00717E23: InitializeCriticalSectionAndSpinCount.KERNEL32(007AAC68,00000FA0,?,?,00717B51,00715E77,007A6C70,00000014), ref: 00717E41
                                                                                                                    • __mtterm.LIBCMT ref: 00717B55
                                                                                                                      • Part of subcall function 00717BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00717B5A,00715E77,007A6C70,00000014), ref: 00717D3F
                                                                                                                      • Part of subcall function 00717BBD: _free.LIBCMT ref: 00717D46
                                                                                                                      • Part of subcall function 00717BBD: DeleteCriticalSection.KERNEL32(007AAC68,?,?,00717B5A,00715E77,007A6C70,00000014), ref: 00717D68
                                                                                                                    • __calloc_crt.LIBCMT ref: 00717B7A
                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00717BA3
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2942034483-0
                                                                                                                    • Opcode ID: 9becbf11548b521c31ad81169b2fb9d12643be997e6fab9553b0d790d61e29b1
                                                                                                                    • Instruction ID: fd25ae61f3bedb8610f88d77b05397c0512927e2d28f2dbc56429ef786604fa6
                                                                                                                    • Opcode Fuzzy Hash: 9becbf11548b521c31ad81169b2fb9d12643be997e6fab9553b0d790d61e29b1
                                                                                                                    • Instruction Fuzzy Hash: 6BF062B251D31199E73D763C7C0A6CA27F49F02730B208699F864C60D1EB2D89C1C169
                                                                                                                    Function 015B3608 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154fileCOMMON
                                                                                                                    Download Yara Rule

                                                                                                                    Control-flow Graph

                                                                                                                    • Executed
                                                                                                                    • Not Executed
                                                                                                                    control_flow_graph 1498 15b3608-15b375b call 15b1258 call 15b34f8 CreateFileW 1505 15b375d 1498->1505 1506 15b3762-15b3772 1498->1506 1507 15b3812-15b3817 1505->1507 1509 15b3779-15b3793 VirtualAlloc 1506->1509 1510 15b3774 1506->1510 1511 15b3797-15b37ae ReadFile 1509->1511 1512 15b3795 1509->1512 1510->1507 1513 15b37b2-15b37ec call 15b3538 call 15b24f8 1511->1513 1514 15b37b0 1511->1514 1512->1507 1519 15b3808-15b3810 ExitProcess 1513->1519 1520 15b37ee-15b3803 call 15b3588 1513->1520 1514->1507 1519->1507 1520->1519
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 015B34F8: Sleep.KERNELBASE(000001F4), ref: 015B3509
                                                                                                                    • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 015B3751
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1320267375.00000000015B1000.00000040.00000020.00020000.00000000.sdmp, Offset: 015B1000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_15b1000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateFileSleep
                                                                                                                    • String ID: 0XOXW0OOIQRL2X3Q5EAG7O6Z6K
                                                                                                                    • API String ID: 2694422964-4105241689
                                                                                                                    • Opcode ID: 02c407a7b45122b878de0e4abddc37869cd9028e3df77691a5b60e5810bceddf
                                                                                                                    • Instruction ID: 4b4763c5d94454c72ea05f27784e6923d671c081386b6af27b1cf0505dccce22
                                                                                                                    • Opcode Fuzzy Hash: 02c407a7b45122b878de0e4abddc37869cd9028e3df77691a5b60e5810bceddf
                                                                                                                    • Instruction Fuzzy Hash: D361B470D04289EAEF11DBF4C858BEEBBB4AF15304F004199E6487B2C1D7B91B49CB66
                                                                                                                    Function 006F4A30 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F5374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007B1148,?,006F61FF,?,00000000,00000001,00000000), ref: 006F5392
                                                                                                                      • Part of subcall function 006F49FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 006F4A1D
                                                                                                                    • _wcscat.LIBCMT ref: 00762D80
                                                                                                                    • _wcscat.LIBCMT ref: 00762DB5
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _wcscat$FileModuleNameOpen
                                                                                                                    • String ID: 8!{$\$\Include\
                                                                                                                    • API String ID: 3592542968-880357949
                                                                                                                    • Opcode ID: ab5700d36e35dacfc0a76f317a18d9a773a4d5c6b43aeba8189e8096c6f87ce1
                                                                                                                    • Instruction ID: 3385c2305b29f12fb79a03ed8cb5f7b902f1e4ebc2bb3151d1da6122a3bb15da
                                                                                                                    • Opcode Fuzzy Hash: ab5700d36e35dacfc0a76f317a18d9a773a4d5c6b43aeba8189e8096c6f87ce1
                                                                                                                    • Instruction Fuzzy Hash: 3F51D67150534C9FC344EF5DD881DAAB3F9FF49300B408A2EF645832A2EB38994ACB59
                                                                                                                    Function 006F51AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 006F522F
                                                                                                                    • _wcscpy.LIBCMT ref: 006F5283
                                                                                                                    • Shell_NotifyIconW.SHELL32(00000001,?), ref: 006F5293
                                                                                                                    • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00763CB0
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: IconLoadNotifyShell_String_memset_wcscpy
                                                                                                                    • String ID: Line:
                                                                                                                    • API String ID: 1053898822-1585850449
                                                                                                                    • Opcode ID: 1e60dd3aa7cf9f0a6f39d6eea85c3a4282e6ed7d050c20808ff226837d7fa85e
                                                                                                                    • Instruction ID: 3e4056ee0583ba54331d705e9d34f5024f8f113ac13c9e0c3b1a90e55a4c6435
                                                                                                                    • Opcode Fuzzy Hash: 1e60dd3aa7cf9f0a6f39d6eea85c3a4282e6ed7d050c20808ff226837d7fa85e
                                                                                                                    • Instruction Fuzzy Hash: E031D571108748AFD360EB60DC46FEF77E9AF44310F40861EF78692191DB74AA48CB9A
                                                                                                                    Function 006F4139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F41A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,006F39FE,?,00000001), ref: 006F41DB
                                                                                                                    • _free.LIBCMT ref: 007636B7
                                                                                                                    • _free.LIBCMT ref: 007636FE
                                                                                                                      • Part of subcall function 006FC833: __wsplitpath.LIBCMT ref: 006FC93E
                                                                                                                      • Part of subcall function 006FC833: _wcscpy.LIBCMT ref: 006FC953
                                                                                                                      • Part of subcall function 006FC833: _wcscat.LIBCMT ref: 006FC968
                                                                                                                      • Part of subcall function 006FC833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 006FC978
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
                                                                                                                    • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                                                                                    • API String ID: 805182592-1757145024
                                                                                                                    • Opcode ID: f6dce87a47ec948614630d57346eda03ea53988c69237037e273a6227f192e57
                                                                                                                    • Instruction ID: 0c683d7aebdcd0fbcd2b403216d5f30eee1e1ac0daa00c6c6ea334c39aab5334
                                                                                                                    • Opcode Fuzzy Hash: f6dce87a47ec948614630d57346eda03ea53988c69237037e273a6227f192e57
                                                                                                                    • Instruction Fuzzy Hash: F9916D71910219EFCF04EFA4CC959FEB7B5BF08310F104529F916AB292DB789A15CB64
                                                                                                                    Function 006F40E5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 00763725
                                                                                                                    • GetOpenFileNameW.COMDLG32 ref: 0076376F
                                                                                                                      • Part of subcall function 006F660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006F53B1,?,?,006F61FF,?,00000000,00000001,00000000), ref: 006F662F
                                                                                                                      • Part of subcall function 006F40A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006F40C6
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Name$Path$FileFullLongOpen_memset
                                                                                                                    • String ID: X$t3z
                                                                                                                    • API String ID: 3777226403-4132599520
                                                                                                                    • Opcode ID: ed7965d79d7165196ff578cf149a2e1af17629e93550fc7a6c7f9e4bbbe888f4
                                                                                                                    • Instruction ID: 7b5223b357bf2232471b97b2ea4a4fda17b3f284cc0beb9f68a131f7d05bc47a
                                                                                                                    • Opcode Fuzzy Hash: ed7965d79d7165196ff578cf149a2e1af17629e93550fc7a6c7f9e4bbbe888f4
                                                                                                                    • Instruction Fuzzy Hash: CF21A171A0018CABCB41DF98C845BFEBBF99F89300F008029F505A7241DFB85A898F65
                                                                                                                    Function 007134AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __getstream.LIBCMT ref: 007134FE
                                                                                                                      • Part of subcall function 00717C0E: __getptd_noexit.LIBCMT ref: 00717C0E
                                                                                                                    • @_EH4_CallFilterFunc@8.LIBCMT ref: 00713539
                                                                                                                    • __wopenfile.LIBCMT ref: 00713549
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
                                                                                                                    • String ID: <G
                                                                                                                    • API String ID: 1820251861-2138716496
                                                                                                                    • Opcode ID: b609a16a2f34923ab8fed64a9b465b07004fef5b93c137ac955073d91b122ed4
                                                                                                                    • Instruction ID: 76408adc994c0bdc5274a4ca628589436684fe4aa401696800389182aa924125
                                                                                                                    • Opcode Fuzzy Hash: b609a16a2f34923ab8fed64a9b465b07004fef5b93c137ac955073d91b122ed4
                                                                                                                    • Instruction Fuzzy Hash: A61101B0A00206DADB22BF7C8C026EE36A5AF45750B148525E814DB2C1EA3CCAD1DBB1
                                                                                                                    Function 0070D298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,0070D28B,SwapMouseButtons,00000004,?), ref: 0070D2BC
                                                                                                                    • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,0070D28B,SwapMouseButtons,00000004,?,?,?,?,0070C865), ref: 0070D2DD
                                                                                                                    • RegCloseKey.KERNELBASE(00000000,?,?,0070D28B,SwapMouseButtons,00000004,?,?,?,?,0070C865), ref: 0070D2FF
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CloseOpenQueryValue
                                                                                                                    • String ID: Control Panel\Mouse
                                                                                                                    • API String ID: 3677997916-824357125
                                                                                                                    • Opcode ID: b1d26198499ec1087c4b973bb5f9491997da52451dd3d7c2413d023e3dc28467
                                                                                                                    • Instruction ID: c268b099a3ad38329a7a5458a42c5c52511ceb8c2a83edaaf2fa901b23f2a909
                                                                                                                    • Opcode Fuzzy Hash: b1d26198499ec1087c4b973bb5f9491997da52451dd3d7c2413d023e3dc28467
                                                                                                                    • Instruction Fuzzy Hash: D3112775611208FFDB208FA4CC84EAEBBF8EF44744F108669A805D7250E635AE419B64
                                                                                                                    Function 015B24F8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateProcessW.KERNELBASE(?,00000000), ref: 015B2CB3
                                                                                                                    • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015B2D49
                                                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015B2D6B
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1320267375.00000000015B1000.00000040.00000020.00020000.00000000.sdmp, Offset: 015B1000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_15b1000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2438371351-0
                                                                                                                    • Opcode ID: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
                                                                                                                    • Instruction ID: 4fe94dc0abc90614ae40bb0d7bed6dda39d8f42c5759e98673bfe39ea3f301f6
                                                                                                                    • Opcode Fuzzy Hash: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
                                                                                                                    • Instruction Fuzzy Hash: 8462FB30A142589BEB24CFA4C890BDEB776FF58300F1095A9D10DEB394E7769E81CB59
                                                                                                                    Function 0071365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _memset$__filbuf__getptd_noexit_memcpy_s
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3877424927-0
                                                                                                                    • Opcode ID: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
                                                                                                                    • Instruction ID: 9ddd7974606bc062943cac45eaae25ced02c72cc5d74b2143ed2e8b6590156ee
                                                                                                                    • Opcode Fuzzy Hash: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
                                                                                                                    • Instruction Fuzzy Hash: D451A2B0A00305EBDB248FAD88856EE7BB5AF40320F248769F835962D0D7799FD0CB50
                                                                                                                    Function 0073C396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F4517: _fseek.LIBCMT ref: 006F452F
                                                                                                                      • Part of subcall function 0073C56D: _wcscmp.LIBCMT ref: 0073C65D
                                                                                                                      • Part of subcall function 0073C56D: _wcscmp.LIBCMT ref: 0073C670
                                                                                                                    • _free.LIBCMT ref: 0073C4DD
                                                                                                                    • _free.LIBCMT ref: 0073C4E4
                                                                                                                    • _free.LIBCMT ref: 0073C54F
                                                                                                                      • Part of subcall function 00711C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00717A85), ref: 00711CB1
                                                                                                                      • Part of subcall function 00711C9D: GetLastError.KERNEL32(00000000,?,00717A85), ref: 00711CC3
                                                                                                                    • _free.LIBCMT ref: 0073C557
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1552873950-0
                                                                                                                    • Opcode ID: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
                                                                                                                    • Instruction ID: 4cce8746d9a2f5733b47f2f1318c6838bc7b89a1c3530a78de6d86812fd23ca6
                                                                                                                    • Opcode Fuzzy Hash: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
                                                                                                                    • Instruction Fuzzy Hash: D95150B1904218AFDF159F68DC85BAEBBB9EF48304F10009EF219B7242DB755A908F58
                                                                                                                    Function 0070EB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 0070EBB2
                                                                                                                      • Part of subcall function 006F51AF: _memset.LIBCMT ref: 006F522F
                                                                                                                      • Part of subcall function 006F51AF: _wcscpy.LIBCMT ref: 006F5283
                                                                                                                      • Part of subcall function 006F51AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 006F5293
                                                                                                                    • KillTimer.USER32(?,00000001,?,?), ref: 0070EC07
                                                                                                                    • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0070EC16
                                                                                                                    • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00763C88
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1378193009-0
                                                                                                                    • Opcode ID: 0361e3daa81f9669637bceec15a5ef441d418532b13ec0dbc7bf199b2ba735bd
                                                                                                                    • Instruction ID: 9273f3e7b8b77ea3fa3b04148dc532c72f76b2bff70404243346e67607128342
                                                                                                                    • Opcode Fuzzy Hash: 0361e3daa81f9669637bceec15a5ef441d418532b13ec0dbc7bf199b2ba735bd
                                                                                                                    • Instruction Fuzzy Hash: E52195705047949FF7329B28C859BE7BBFC9B45308F04058DE69F662C1C3796A84CB65
                                                                                                                    Function 0073C71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetTempPathW.KERNEL32(00000104,?), ref: 0073C72F
                                                                                                                    • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0073C746
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Temp$FileNamePath
                                                                                                                    • String ID: aut
                                                                                                                    • API String ID: 3285503233-3010740371
                                                                                                                    • Opcode ID: 05642959e0daa4b046570dcaa883e84269e6a41d0e257b71770f9da4d9a923f0
                                                                                                                    • Instruction ID: f157461aad096aec7b4163e3f62c253d0c77fe27e7e519aed45bc3b71e7c11a1
                                                                                                                    • Opcode Fuzzy Hash: 05642959e0daa4b046570dcaa883e84269e6a41d0e257b71770f9da4d9a923f0
                                                                                                                    • Instruction Fuzzy Hash: 14D05B7154030D6BDB509B50DC0DF86777C6B00744F0041507654950B2DAF4E6D68B54
                                                                                                                    Function 0074F8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: f177334f0ebf6ea4a042db33225fbf3941ea49454bb4bd11b8773d7371fa11d1
                                                                                                                    • Instruction ID: b4694d8c4bb91b10bbabb943b1a7ac39e8cb9ec0499a298941069b26667d4c41
                                                                                                                    • Opcode Fuzzy Hash: f177334f0ebf6ea4a042db33225fbf3941ea49454bb4bd11b8773d7371fa11d1
                                                                                                                    • Instruction Fuzzy Hash: 33F16771608301DFD710DF24C895B6AB7E5FF89314F10892EF9999B292D738E905CB82
                                                                                                                    Function 006F4FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 006F5022
                                                                                                                    • Shell_NotifyIconW.SHELL32(00000000,?), ref: 006F50CB
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: IconNotifyShell__memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 928536360-0
                                                                                                                    • Opcode ID: 425df90782398a6492102c2dfceed23e8e04019c4d5d91c7c65e7ec1ae7b7781
                                                                                                                    • Instruction ID: ff4ee6eb734cc214919c04c294b1b3b5625c560711fa9c2957b89cee81a3a290
                                                                                                                    • Opcode Fuzzy Hash: 425df90782398a6492102c2dfceed23e8e04019c4d5d91c7c65e7ec1ae7b7781
                                                                                                                    • Instruction Fuzzy Hash: 0531AEB0504704DFC320EF28D845AABBBE4FF48304F40492EF69A82241EB756984CB96
                                                                                                                    Function 0071395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __FF_MSGBANNER.LIBCMT ref: 00713973
                                                                                                                      • Part of subcall function 007181C2: __NMSG_WRITE.LIBCMT ref: 007181E9
                                                                                                                      • Part of subcall function 007181C2: __NMSG_WRITE.LIBCMT ref: 007181F3
                                                                                                                    • __NMSG_WRITE.LIBCMT ref: 0071397A
                                                                                                                      • Part of subcall function 0071821F: GetModuleFileNameW.KERNEL32(00000000,007B0312,00000104,00000000,00000001,00000000), ref: 007182B1
                                                                                                                      • Part of subcall function 0071821F: ___crtMessageBoxW.LIBCMT ref: 0071835F
                                                                                                                      • Part of subcall function 00711145: ___crtCorExitProcess.LIBCMT ref: 0071114B
                                                                                                                      • Part of subcall function 00711145: ExitProcess.KERNEL32 ref: 00711154
                                                                                                                      • Part of subcall function 00717C0E: __getptd_noexit.LIBCMT ref: 00717C0E
                                                                                                                    • RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,00000000,?,?,0070F507,?,0000000E), ref: 0071399F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1372826849-0
                                                                                                                    • Opcode ID: 719b5523bef77007911fdec72b402cfda6a0bf4eff9597aaa1ed619840112233
                                                                                                                    • Instruction ID: 2c3533da8293c98d7fc3e11ff2537f98775536d29aa7856ce203f27d6ecae522
                                                                                                                    • Opcode Fuzzy Hash: 719b5523bef77007911fdec72b402cfda6a0bf4eff9597aaa1ed619840112233
                                                                                                                    • Instruction Fuzzy Hash: AB01D236245211EAE7253B2CDC4ABEA335C9B81768B610129F5059A1C2DFBCEDC08AA4
                                                                                                                    Function 0073C6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,0073C385,?,?,?,?,?,00000004), ref: 0073C6F2
                                                                                                                    • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,0073C385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 0073C708
                                                                                                                    • CloseHandle.KERNEL32(00000000,?,0073C385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0073C70F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: File$CloseCreateHandleTime
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3397143404-0
                                                                                                                    • Opcode ID: b49fa3ee17d5ede22efc65cdd439442f3f1d179b7ad9229dbfe141b159cc01d8
                                                                                                                    • Instruction ID: f01ed116114943fd0fc4ae6629b6a3f8478f1ace207c009fb804942321e7dba0
                                                                                                                    • Opcode Fuzzy Hash: b49fa3ee17d5ede22efc65cdd439442f3f1d179b7ad9229dbfe141b159cc01d8
                                                                                                                    • Instruction Fuzzy Hash: C8E08632140218B7E7312B54AC09FCA7B29AF057A1F108110FB18790E197B52951879C
                                                                                                                    Function 0073BB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _free.LIBCMT ref: 0073BB72
                                                                                                                      • Part of subcall function 00711C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00717A85), ref: 00711CB1
                                                                                                                      • Part of subcall function 00711C9D: GetLastError.KERNEL32(00000000,?,00717A85), ref: 00711CC3
                                                                                                                    • _free.LIBCMT ref: 0073BB83
                                                                                                                    • _free.LIBCMT ref: 0073BB95
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 776569668-0
                                                                                                                    • Opcode ID: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
                                                                                                                    • Instruction ID: cd0007263fb62f70fe32b97a4ba874ef53092a6767c4adfa245ab7a7597957a6
                                                                                                                    • Opcode Fuzzy Hash: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
                                                                                                                    • Instruction Fuzzy Hash: ACE012E164174186EB24697D6E49EF763CC4F04351B54081DB659EB187DF2CE88085F4
                                                                                                                    Function 006F2322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F22A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,006F24F1), ref: 006F2303
                                                                                                                    • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 006F25A1
                                                                                                                    • CoInitialize.OLE32(00000000), ref: 006F2618
                                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0076503A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Handle$CloseInitializeMessageRegisterWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3815369404-0
                                                                                                                    • Opcode ID: ce1385780f3729e19468112550c3ee4c01549af6b5017f6a698b1dc9be7baaec
                                                                                                                    • Instruction ID: 5e46257d9a774d0aabf7da2c38bb96a587209cd357416be4b347105f1cb40ef3
                                                                                                                    • Opcode Fuzzy Hash: ce1385780f3729e19468112550c3ee4c01549af6b5017f6a698b1dc9be7baaec
                                                                                                                    • Instruction Fuzzy Hash: 4371ACB5A012898A8714EF6AA8B4F95BBE5BB983447E0C36ED109C7772DB3C4410CF5C
                                                                                                                    Function 0073BBE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __fread_nolock
                                                                                                                    • String ID: EA06
                                                                                                                    • API String ID: 2638373210-3962188686
                                                                                                                    • Opcode ID: f5e6f199dd99fd1601e152ba0f3b853916e248cb4ead4ea7b90403b6794ed927
                                                                                                                    • Instruction ID: 46708c4877ead17a1adf0fa2a2726438dcf2d7b109fcd6483553215ee1a3b38d
                                                                                                                    • Opcode Fuzzy Hash: f5e6f199dd99fd1601e152ba0f3b853916e248cb4ead4ea7b90403b6794ed927
                                                                                                                    • Instruction Fuzzy Hash: 0B01DD71904258BEDB28C798CC56FEE7BF89B15305F00455AF557D61C1D578E7088B70
                                                                                                                    Function 00750828 Relevance: 3.2, APIs: 2, Instructions: 232COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _strcat.LIBCMT ref: 007508FD
                                                                                                                      • Part of subcall function 006F936C: __swprintf.LIBCMT ref: 006F93AB
                                                                                                                      • Part of subcall function 006F936C: __itow.LIBCMT ref: 006F93DF
                                                                                                                    • _wcscpy.LIBCMT ref: 0075098C
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __itow__swprintf_strcat_wcscpy
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1012013722-0
                                                                                                                    • Opcode ID: 74149057429157d25c9a41c91fb9e8a943c8866a6fe977ac872e749af741afe7
                                                                                                                    • Instruction ID: 7ff6713e0120c9bc9a8d82ffb9d9656d966bb11b545af5a31c6f523f015f2bc9
                                                                                                                    • Opcode Fuzzy Hash: 74149057429157d25c9a41c91fb9e8a943c8866a6fe977ac872e749af741afe7
                                                                                                                    • Instruction Fuzzy Hash: 25912535A00608DFCB18DF28C5959A9B7E5EF49311B54C06AED1A8F3A2DB74EE45CB80
                                                                                                                    Function 006F3A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • IsThemeActive.UXTHEME ref: 006F3A73
                                                                                                                      • Part of subcall function 00711405: __lock.LIBCMT ref: 0071140B
                                                                                                                      • Part of subcall function 006F3ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 006F3AF3
                                                                                                                      • Part of subcall function 006F3ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 006F3B08
                                                                                                                      • Part of subcall function 006F3D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,006F3AA3,?), ref: 006F3D45
                                                                                                                      • Part of subcall function 006F3D19: IsDebuggerPresent.KERNEL32(?,?,?,?,006F3AA3,?), ref: 006F3D57
                                                                                                                      • Part of subcall function 006F3D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,007B1148,007B1130,?,?,?,?,006F3AA3,?), ref: 006F3DC8
                                                                                                                      • Part of subcall function 006F3D19: SetCurrentDirectoryW.KERNEL32(?,?,?,006F3AA3,?), ref: 006F3E48
                                                                                                                    • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 006F3AB3
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 924797094-0
                                                                                                                    • Opcode ID: d242b34f549b160af59ddba11d09376ffd747ca0fc7ffb502f515e12036d1881
                                                                                                                    • Instruction ID: 74c96b2b7e9423564c4b0ab61d88cf86caf8331f50ad12400deb1c5119ee5e37
                                                                                                                    • Opcode Fuzzy Hash: d242b34f549b160af59ddba11d09376ffd747ca0fc7ffb502f515e12036d1881
                                                                                                                    • Instruction Fuzzy Hash: 5E11C371904344DBC300EF19EC49A1AFBE9EF94750F40861EF984872A2DB789585CB96
                                                                                                                    Function 0071E9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • ___lock_fhandle.LIBCMT ref: 0071EA29
                                                                                                                    • __close_nolock.LIBCMT ref: 0071EA42
                                                                                                                      • Part of subcall function 00717BDA: __getptd_noexit.LIBCMT ref: 00717BDA
                                                                                                                      • Part of subcall function 00717C0E: __getptd_noexit.LIBCMT ref: 00717C0E
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __getptd_noexit$___lock_fhandle__close_nolock
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1046115767-0
                                                                                                                    • Opcode ID: ade26692b2796859d49cee17e498048cd466bc6abb39884d7172c9f0c3fe40c7
                                                                                                                    • Instruction ID: ceadbc2d05fd4224db65bdba9265d6a415cf8dc681fd48f88287490142baef96
                                                                                                                    • Opcode Fuzzy Hash: ade26692b2796859d49cee17e498048cd466bc6abb39884d7172c9f0c3fe40c7
                                                                                                                    • Instruction Fuzzy Hash: 27118672909610DAD725BF6CC8457E97A616F81331F268350E8215F1E3C7BC99C0CAE5
                                                                                                                    Function 0070F4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0071395C: __FF_MSGBANNER.LIBCMT ref: 00713973
                                                                                                                      • Part of subcall function 0071395C: __NMSG_WRITE.LIBCMT ref: 0071397A
                                                                                                                      • Part of subcall function 0071395C: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,00000000,?,?,0070F507,?,0000000E), ref: 0071399F
                                                                                                                    • std::exception::exception.LIBCMT ref: 0070F51E
                                                                                                                    • __CxxThrowException@8.LIBCMT ref: 0070F533
                                                                                                                      • Part of subcall function 00716805: RaiseException.KERNEL32(?,?,0000000E,007A6A30,?,?,?,0070F538,0000000E,007A6A30,?,00000001), ref: 00716856
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3902256705-0
                                                                                                                    • Opcode ID: 44aba6f8df270565e8b04eda81bd36705da4f3327ef64e0ab860bf63d1ab93b2
                                                                                                                    • Instruction ID: c037f62f04bf262d091ed6f5f1c5b90b2a11b459ba917879d368a2bf072e99ac
                                                                                                                    • Opcode Fuzzy Hash: 44aba6f8df270565e8b04eda81bd36705da4f3327ef64e0ab860bf63d1ab93b2
                                                                                                                    • Instruction Fuzzy Hash: E8F0A43110421DE7DB24BFACDC169DE77E8AF00754F608636F908E25C1DBB89A8486E5
                                                                                                                    Function 00713839 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __lock_file_memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 26237723-0
                                                                                                                    • Opcode ID: a9e06afb2997d099cac8018306fd8068d560bbf0f0436ed94efe90e5ad741b7c
                                                                                                                    • Instruction ID: cca8d98b888abf75b611be2869d002e47885d619d25623882e2c727048ccad68
                                                                                                                    • Opcode Fuzzy Hash: a9e06afb2997d099cac8018306fd8068d560bbf0f0436ed94efe90e5ad741b7c
                                                                                                                    • Instruction Fuzzy Hash: 0E012571900205EACF21AFAD8C065DE7B71AF40750F154259F424561E1D7798BE1DBA1
                                                                                                                    Function 007135E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00717C0E: __getptd_noexit.LIBCMT ref: 00717C0E
                                                                                                                    • __lock_file.LIBCMT ref: 00713629
                                                                                                                      • Part of subcall function 00714E1C: __lock.LIBCMT ref: 00714E3F
                                                                                                                    • __fclose_nolock.LIBCMT ref: 00713634
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2800547568-0
                                                                                                                    • Opcode ID: 6e417ccba323e7091629bbdd4e3635711db213fd0dc134edf2068fe5d345be94
                                                                                                                    • Instruction ID: d595b6284f432304669e325909e61d5ff089c6c32a3f543dac77d02595d41c0e
                                                                                                                    • Opcode Fuzzy Hash: 6e417ccba323e7091629bbdd4e3635711db213fd0dc134edf2068fe5d345be94
                                                                                                                    • Instruction Fuzzy Hash: 8DF0B471901204EADB117F7D880A7EE7AB06F81730F258249E420AB2C1CB7C8BC1DFA5
                                                                                                                    Function 015B24F5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateProcessW.KERNELBASE(?,00000000), ref: 015B2CB3
                                                                                                                    • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015B2D49
                                                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015B2D6B
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1320267375.00000000015B1000.00000040.00000020.00020000.00000000.sdmp, Offset: 015B1000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_15b1000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2438371351-0
                                                                                                                    • Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                                                                    • Instruction ID: e875afa2bfb778d99ecc8434807d4688d56dac069ac36fd56d5c9f51db2ac10d
                                                                                                                    • Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                                                                    • Instruction Fuzzy Hash: 9012DD24E24658C6EB24DF64D8507DEB232FF68300F1094E9910DEB7A5E77A4E81CB5A
                                                                                                                    Function 006FE8A0 Relevance: 1.7, APIs: 1, Instructions: 187COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 350ee9a3cb11393a5b8d2c79ae9c6d6ba92edcdd77f156859433183c6d41089c
                                                                                                                    • Instruction ID: 2dabb0e097f0c67fa9b09d8fb84eada9545f43988ea031489686325acff0aedf
                                                                                                                    • Opcode Fuzzy Hash: 350ee9a3cb11393a5b8d2c79ae9c6d6ba92edcdd77f156859433183c6d41089c
                                                                                                                    • Instruction Fuzzy Hash: 3A71D7709053888FDB35CF28C8557A97FD1BB51304F084A6EED868B3A2D77A9885DB42
                                                                                                                    Function 00712957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __flush.LIBCMT ref: 00712A0B
                                                                                                                      • Part of subcall function 00717C0E: __getptd_noexit.LIBCMT ref: 00717C0E
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __flush__getptd_noexit
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4101623367-0
                                                                                                                    • Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                                                                                    • Instruction ID: 334892eca8af998c40bc4839b2cc3f4d76df636d173efd89116082f2f121604f
                                                                                                                    • Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                                                                                    • Instruction Fuzzy Hash: 9B41B8707007069FDF288E6DC8815EE77A6AF44360B24C52DE845D71C2EA78DDE28B40
                                                                                                                    Function 0070ED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ProtectVirtual
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 544645111-0
                                                                                                                    • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                    • Instruction ID: b406bc93fbd724c1472908e9a05762ed50c31748d2c56df2278cd8bc9b6019ba
                                                                                                                    • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                    • Instruction Fuzzy Hash: 3D31B275B00106DBD718DF58C490A69FBE6FB89340B648BA5E409CB296DB35EDC1CBD0
                                                                                                                    Function 0075040F Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _free
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 269201875-0
                                                                                                                    • Opcode ID: f6d949e8a7af3f15865402b4d2b7007be287fc8e04c149733ffb088b4e9bb253
                                                                                                                    • Instruction ID: 362e16574f7ac7cfca1dfeda4b8ae5b9238bbdf4e34092f1d1b260892b7eb7b5
                                                                                                                    • Opcode Fuzzy Hash: f6d949e8a7af3f15865402b4d2b7007be287fc8e04c149733ffb088b4e9bb253
                                                                                                                    • Instruction Fuzzy Hash: 5431A476104518DFCB019F10D099AAE77B1FF49321F10844AEE951F386E7B8A919CFD1
                                                                                                                    Function 00769A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ClearVariant
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1473721057-0
                                                                                                                    • Opcode ID: 60e91be030033e0f63f319e6e6278815742c3d5550a607c70a0e1d9e8d8f035c
                                                                                                                    • Instruction ID: 550225c28069e585fa546b4d64d7c49891daaea2ef3b654809361bc577f81b1d
                                                                                                                    • Opcode Fuzzy Hash: 60e91be030033e0f63f319e6e6278815742c3d5550a607c70a0e1d9e8d8f035c
                                                                                                                    • Instruction Fuzzy Hash: 61413D70504651CFDB24DF14C444B1ABBE1BF45314F198AACE99A4B7A2C37AF885CF92
                                                                                                                    Function 0071ED06 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __getptd_noexit
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3074181302-0
                                                                                                                    • Opcode ID: 0b2f16805c073b9f6edf40c11b8aa7aacef2ecdf19a8cd5fa673cf91d18b365f
                                                                                                                    • Instruction ID: 5916ae0d4ed3e8177cbcf3ebf12b815313721441b70cac5a4f114b227ca6ec72
                                                                                                                    • Opcode Fuzzy Hash: 0b2f16805c073b9f6edf40c11b8aa7aacef2ecdf19a8cd5fa673cf91d18b365f
                                                                                                                    • Instruction Fuzzy Hash: 8A216FB2A09640DBE7267F6CD8497D93A616F42336F264740E8605B1E2DB7C8980CBA5
                                                                                                                    Function 006F41A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F4214: FreeLibrary.KERNEL32(00000000,?), ref: 006F4247
                                                                                                                    • LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,006F39FE,?,00000001), ref: 006F41DB
                                                                                                                      • Part of subcall function 006F4291: FreeLibrary.KERNEL32(00000000), ref: 006F42C4
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Library$Free$Load
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2391024519-0
                                                                                                                    • Opcode ID: b9d1c53eb002c23fa8e602d1c302e06db71f4988a870f49694bb18a721af5637
                                                                                                                    • Instruction ID: 82f16ffc40620ae69827c289aa6495a7a1d081077b804be65ec6e1d5abca59c7
                                                                                                                    • Opcode Fuzzy Hash: b9d1c53eb002c23fa8e602d1c302e06db71f4988a870f49694bb18a721af5637
                                                                                                                    • Instruction Fuzzy Hash: E111A33160020AABDB10EB74DC16FBF77EAAF40700F10843DBA96A65C5DF799B419B64
                                                                                                                    Function 00769B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ClearVariant
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1473721057-0
                                                                                                                    • Opcode ID: 02bf8f115ea9bbf3b83f26e33e3b6ffc30633d5e89b663949242d3ee6a591727
                                                                                                                    • Instruction ID: 835b58d5be83c02def80d19e05e7c9cc80e52563cf1a0f41b9f775f7d9aca30c
                                                                                                                    • Opcode Fuzzy Hash: 02bf8f115ea9bbf3b83f26e33e3b6ffc30633d5e89b663949242d3ee6a591727
                                                                                                                    • Instruction Fuzzy Hash: A6212A70504601DFDB24DF24C448B1ABBF1BF84314F144A6CF996476A2D739E855CF92
                                                                                                                    Function 0071AF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • ___lock_fhandle.LIBCMT ref: 0071AFC0
                                                                                                                      • Part of subcall function 00717BDA: __getptd_noexit.LIBCMT ref: 00717BDA
                                                                                                                      • Part of subcall function 00717C0E: __getptd_noexit.LIBCMT ref: 00717C0E
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __getptd_noexit$___lock_fhandle
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1144279405-0
                                                                                                                    • Opcode ID: bf6120d27a9feb73a73f760b80f99013a7294337d51fc216c691321246b17471
                                                                                                                    • Instruction ID: 534b3339bbed849f8b74878ca326379eb49909508f3739a983aabae79fd97678
                                                                                                                    • Opcode Fuzzy Hash: bf6120d27a9feb73a73f760b80f99013a7294337d51fc216c691321246b17471
                                                                                                                    • Instruction Fuzzy Hash: C81160B2809600DFD7266FACC84A7D93A60AF45336F164340E4345B1E2D7BC89C5DBA1
                                                                                                                    Function 006F39DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: LibraryLoad
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1029625771-0
                                                                                                                    • Opcode ID: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
                                                                                                                    • Instruction ID: 8a67bd14c57fa1afdbb0d7573fc531debad59c8c39f031ff1a18a0a6865186fc
                                                                                                                    • Opcode Fuzzy Hash: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
                                                                                                                    • Instruction Fuzzy Hash: 3601367150010DEECF45EF64C8918FFBB75AF10344F108069B656971A6EA349B49DF64
                                                                                                                    Function 00712AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __lock_file.LIBCMT ref: 00712AED
                                                                                                                      • Part of subcall function 00717C0E: __getptd_noexit.LIBCMT ref: 00717C0E
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __getptd_noexit__lock_file
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2597487223-0
                                                                                                                    • Opcode ID: 323c268a003c0955a66af0c2d25702e74e99424472dbc6c15196996b49aa0f84
                                                                                                                    • Instruction ID: fb4843f9dc66f1aa075d8d5b5974a99da8e886ef887173e9668875c29cd5b4b2
                                                                                                                    • Opcode Fuzzy Hash: 323c268a003c0955a66af0c2d25702e74e99424472dbc6c15196996b49aa0f84
                                                                                                                    • Instruction Fuzzy Hash: E6F04971900205EADF25AF6C8C0A7DF3AA5BF40320F158555B814AA1D2D77C8AA2DB91
                                                                                                                    Function 006F4252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • FreeLibrary.KERNEL32(?,?,?,?,?,006F39FE,?,00000001), ref: 006F4286
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: FreeLibrary
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3664257935-0
                                                                                                                    • Opcode ID: 788b9ac7637e9ac8fc10d8fe2ebc0294c2a09276c8fa60ef1a7537a9a3627f8b
                                                                                                                    • Instruction ID: 87e8def65e9a1163371d4a9b1eb4d73179b548b72c821b2e9a627c5a68b74c24
                                                                                                                    • Opcode Fuzzy Hash: 788b9ac7637e9ac8fc10d8fe2ebc0294c2a09276c8fa60ef1a7537a9a3627f8b
                                                                                                                    • Instruction Fuzzy Hash: AFF03971509706CFCB349F64D894867BBF6BF053253248A3EF2D682A10CB369A80DF50
                                                                                                                    Function 006F40A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006F40C6
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: LongNamePath
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 82841172-0
                                                                                                                    • Opcode ID: 60ead1826cd03e6a9cf68b0ec346fb96e99895813c76ec1959fc20a5abdb64f5
                                                                                                                    • Instruction ID: 5ad11fbc76a82de7e784853065bda613e977cc30528169d3638132ee7345105f
                                                                                                                    • Opcode Fuzzy Hash: 60ead1826cd03e6a9cf68b0ec346fb96e99895813c76ec1959fc20a5abdb64f5
                                                                                                                    • Instruction Fuzzy Hash: 5FE0CD365001285BC7119658CC46FFA77ADDF88690F054075FA09E7244D9749DC18694
                                                                                                                    Function 0073BCF4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __fread_nolock
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2638373210-0
                                                                                                                    • Opcode ID: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
                                                                                                                    • Instruction ID: ceca5ef72617c402c065f2992271d369f7885bda89537dc6a1ccf2a5dfc4a2c0
                                                                                                                    • Opcode Fuzzy Hash: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
                                                                                                                    • Instruction Fuzzy Hash: 81E0D8B0214B049FD7348B24D800BE373E0EB05305F00081CF29BC3242EB637841C759
                                                                                                                    Function 015B34F8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • Sleep.KERNELBASE(000001F4), ref: 015B3509
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1320267375.00000000015B1000.00000040.00000020.00020000.00000000.sdmp, Offset: 015B1000, based on PE: false
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_15b1000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Sleep
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3472027048-0
                                                                                                                    • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                    • Instruction ID: 4b48fc6fc89060f07746c87ae6c92fe3d678d0f95d769839eb16927cc1d6eda8
                                                                                                                    • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                    • Instruction Fuzzy Hash: A8E0E67498010DDFDB00DFB4D9496DD7BF4FF04301F100161FD01E2280D6309E508A62

                                                                                                                    Non-executed Functions

                                                                                                                    Function 0075AACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0075B1CD
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend
                                                                                                                    • String ID: %d/%02d/%02d
                                                                                                                    • API String ID: 3850602802-328681919
                                                                                                                    • Opcode ID: 169e28240edf1a29aed36fb80477a2828cf11aaa8ce6fe071678eb44a06d458f
                                                                                                                    • Instruction ID: 77d8cab9e054ae318f19227319722301462d1aadfed6b8bd1d7b8aa6967f42b3
                                                                                                                    • Opcode Fuzzy Hash: 169e28240edf1a29aed36fb80477a2828cf11aaa8ce6fe071678eb44a06d458f
                                                                                                                    • Instruction Fuzzy Hash: F312CE71500208AFEB649F64CC49FFA7BB8EF45351F108229F919EA2D0DBB88945CB61
                                                                                                                    Function 0070EB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetForegroundWindow.USER32(00000000,00000000), ref: 0070EB4A
                                                                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00763AEA
                                                                                                                    • IsIconic.USER32(000000FF), ref: 00763AF3
                                                                                                                    • ShowWindow.USER32(000000FF,00000009), ref: 00763B00
                                                                                                                    • SetForegroundWindow.USER32(000000FF), ref: 00763B0A
                                                                                                                    • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00763B20
                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00763B27
                                                                                                                    • GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00763B33
                                                                                                                    • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00763B44
                                                                                                                    • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00763B4C
                                                                                                                    • AttachThreadInput.USER32(00000000,?,00000001), ref: 00763B54
                                                                                                                    • SetForegroundWindow.USER32(000000FF), ref: 00763B57
                                                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00763B6C
                                                                                                                    • keybd_event.USER32(00000012,00000000), ref: 00763B77
                                                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00763B81
                                                                                                                    • keybd_event.USER32(00000012,00000000), ref: 00763B86
                                                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00763B8F
                                                                                                                    • keybd_event.USER32(00000012,00000000), ref: 00763B94
                                                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00763B9E
                                                                                                                    • keybd_event.USER32(00000012,00000000), ref: 00763BA3
                                                                                                                    • SetForegroundWindow.USER32(000000FF), ref: 00763BA6
                                                                                                                    • AttachThreadInput.USER32(000000FF,?,00000000), ref: 00763BCD
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                                    • String ID: Shell_TrayWnd
                                                                                                                    • API String ID: 4125248594-2988720461
                                                                                                                    • Opcode ID: 9094be3c540dad8117f4de44b34c180f1f506e47357f708cc428ba6d805e8cd6
                                                                                                                    • Instruction ID: 8b5f023b883f44eff65c57a0f389b5440a95d76fc6edddbfc2dcf9486ad5d171
                                                                                                                    • Opcode Fuzzy Hash: 9094be3c540dad8117f4de44b34c180f1f506e47357f708cc428ba6d805e8cd6
                                                                                                                    • Instruction Fuzzy Hash: B63165B1A40318BBEB305B659C49F7F7E7CEF44B90F108015FA09EA1D0D6B95D50EAA4
                                                                                                                    Function 0072ACC5 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 223COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0072B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0072B180
                                                                                                                      • Part of subcall function 0072B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0072B1AD
                                                                                                                      • Part of subcall function 0072B134: GetLastError.KERNEL32 ref: 0072B1BA
                                                                                                                    • _memset.LIBCMT ref: 0072AD08
                                                                                                                    • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 0072AD5A
                                                                                                                    • CloseHandle.KERNEL32(?), ref: 0072AD6B
                                                                                                                    • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 0072AD82
                                                                                                                    • GetProcessWindowStation.USER32 ref: 0072AD9B
                                                                                                                    • SetProcessWindowStation.USER32(00000000), ref: 0072ADA5
                                                                                                                    • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0072ADBF
                                                                                                                      • Part of subcall function 0072AB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,0072ACC0), ref: 0072AB99
                                                                                                                      • Part of subcall function 0072AB84: CloseHandle.KERNEL32(?,?,0072ACC0), ref: 0072ABAB
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                                                                                    • String ID: $H*z$default$winsta0
                                                                                                                    • API String ID: 2063423040-89795958
                                                                                                                    • Opcode ID: 3671c9fba92877bb773b53aea1af547ff4a33b0c5a6af4e398ac47f48743f401
                                                                                                                    • Instruction ID: ef4807878d7cf73f2213361de29ca20443dddb2ac7b8441468dd146c51f67913
                                                                                                                    • Opcode Fuzzy Hash: 3671c9fba92877bb773b53aea1af547ff4a33b0c5a6af4e398ac47f48743f401
                                                                                                                    • Instruction Fuzzy Hash: 66819CB1C00219FFDF219FA4EC49AEE7BB9EF08344F048159F814A21A1D7398E95DB61
                                                                                                                    Function 007360DD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174filestringCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00736EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00735FA6,?), ref: 00736ED8
                                                                                                                      • Part of subcall function 00736EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00735FA6,?), ref: 00736EF1
                                                                                                                      • Part of subcall function 0073725E: __wsplitpath.LIBCMT ref: 0073727B
                                                                                                                      • Part of subcall function 0073725E: __wsplitpath.LIBCMT ref: 0073728E
                                                                                                                      • Part of subcall function 007372CB: GetFileAttributesW.KERNEL32(?,00736019), ref: 007372CC
                                                                                                                    • _wcscat.LIBCMT ref: 00736149
                                                                                                                    • _wcscat.LIBCMT ref: 00736167
                                                                                                                    • __wsplitpath.LIBCMT ref: 0073618E
                                                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 007361A4
                                                                                                                    • _wcscpy.LIBCMT ref: 00736209
                                                                                                                    • _wcscat.LIBCMT ref: 0073621C
                                                                                                                    • _wcscat.LIBCMT ref: 0073622F
                                                                                                                    • lstrcmpiW.KERNEL32(?,?), ref: 0073625D
                                                                                                                    • DeleteFileW.KERNEL32(?), ref: 0073626E
                                                                                                                    • MoveFileW.KERNEL32(?,?), ref: 00736289
                                                                                                                    • MoveFileW.KERNEL32(?,?), ref: 00736298
                                                                                                                    • CopyFileW.KERNEL32(?,?,00000000), ref: 007362AD
                                                                                                                    • DeleteFileW.KERNEL32(?), ref: 007362BE
                                                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 007362E1
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 007362FD
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 0073630B
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
                                                                                                                    • String ID: \*.*
                                                                                                                    • API String ID: 1917200108-1173974218
                                                                                                                    • Opcode ID: 120eb35af9156a7bdf0d0d4f052de801e6c9afb4ff0ac1b36ad2353daf3350f1
                                                                                                                    • Instruction ID: f61a597a24605e3d30a81e16f475d0394917dbb2393da1cb32c132c3ff09c332
                                                                                                                    • Opcode Fuzzy Hash: 120eb35af9156a7bdf0d0d4f052de801e6c9afb4ff0ac1b36ad2353daf3350f1
                                                                                                                    • Instruction Fuzzy Hash: 0A51237280911CAADB21EB95CC48DDF77BCBF05300F0541E6E589E3142DE799B898FA5
                                                                                                                    Function 00746B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • OpenClipboard.USER32(0078DC00), ref: 00746B36
                                                                                                                    • IsClipboardFormatAvailable.USER32(0000000D), ref: 00746B44
                                                                                                                    • GetClipboardData.USER32(0000000D), ref: 00746B4C
                                                                                                                    • CloseClipboard.USER32 ref: 00746B58
                                                                                                                    • GlobalLock.KERNEL32(00000000), ref: 00746B74
                                                                                                                    • CloseClipboard.USER32 ref: 00746B7E
                                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00746B93
                                                                                                                    • IsClipboardFormatAvailable.USER32(00000001), ref: 00746BA0
                                                                                                                    • GetClipboardData.USER32(00000001), ref: 00746BA8
                                                                                                                    • GlobalLock.KERNEL32(00000000), ref: 00746BB5
                                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00746BE9
                                                                                                                    • CloseClipboard.USER32 ref: 00746CF6
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3222323430-0
                                                                                                                    • Opcode ID: 9b28ced41aaab7c22dbc72702096b6aef97c4bec99061ce254187184694d1178
                                                                                                                    • Instruction ID: 2650bf20a66f7171ae53028952927f26941e34da320627bb8f5c26bb858fd1b4
                                                                                                                    • Opcode Fuzzy Hash: 9b28ced41aaab7c22dbc72702096b6aef97c4bec99061ce254187184694d1178
                                                                                                                    • Instruction Fuzzy Hash: 6B51AF71200205ABD320AB60CD96F7E73B8EF45B51F10402DF64AD61E1DF68EC45CA66
                                                                                                                    Function 0073F5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0073F62B
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 0073F67F
                                                                                                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0073F6A4
                                                                                                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0073F6BB
                                                                                                                    • FileTimeToSystemTime.KERNEL32(?,?), ref: 0073F6E2
                                                                                                                    • __swprintf.LIBCMT ref: 0073F72E
                                                                                                                    • __swprintf.LIBCMT ref: 0073F767
                                                                                                                    • __swprintf.LIBCMT ref: 0073F7BB
                                                                                                                      • Part of subcall function 0071172B: __woutput_l.LIBCMT ref: 00711784
                                                                                                                    • __swprintf.LIBCMT ref: 0073F809
                                                                                                                    • __swprintf.LIBCMT ref: 0073F858
                                                                                                                    • __swprintf.LIBCMT ref: 0073F8A7
                                                                                                                    • __swprintf.LIBCMT ref: 0073F8F6
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
                                                                                                                    • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                                                                                    • API String ID: 835046349-2428617273
                                                                                                                    • Opcode ID: c6814974b30c23fa1a40be2d43fceec13a1e711bd91d377e1b49465ecf646eae
                                                                                                                    • Instruction ID: 2e0f0c8ed5f0762eaee65f9637490853512bbfe68ab68a661c99b4e268bba7c0
                                                                                                                    • Opcode Fuzzy Hash: c6814974b30c23fa1a40be2d43fceec13a1e711bd91d377e1b49465ecf646eae
                                                                                                                    • Instruction Fuzzy Hash: EAA110B2408344ABD350EB94C986DBFB7EDBF94704F40092DF685C6192EB34D949CB62
                                                                                                                    Function 00741B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00741B50
                                                                                                                    • _wcscmp.LIBCMT ref: 00741B65
                                                                                                                    • _wcscmp.LIBCMT ref: 00741B7C
                                                                                                                    • GetFileAttributesW.KERNEL32(?), ref: 00741B8E
                                                                                                                    • SetFileAttributesW.KERNEL32(?,?), ref: 00741BA8
                                                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 00741BC0
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 00741BCB
                                                                                                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 00741BE7
                                                                                                                    • _wcscmp.LIBCMT ref: 00741C0E
                                                                                                                    • _wcscmp.LIBCMT ref: 00741C25
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00741C37
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(007A39FC), ref: 00741C55
                                                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 00741C5F
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 00741C6C
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 00741C7C
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                                                                                    • String ID: *.*
                                                                                                                    • API String ID: 1803514871-438819550
                                                                                                                    • Opcode ID: 86241e1672d2ddd491df17e6d8e1bd6292723cbc96efbb0455b58571f53c202a
                                                                                                                    • Instruction ID: 538caa5ab6a43de3b20e4049f57cb6a0c72f7ca7fb37039c137a459f7950f727
                                                                                                                    • Opcode Fuzzy Hash: 86241e1672d2ddd491df17e6d8e1bd6292723cbc96efbb0455b58571f53c202a
                                                                                                                    • Instruction Fuzzy Hash: F931F672541219ABCF20BFA4DC89AEE73BC9F45350F908155F915E2090EB78DEC5CB68
                                                                                                                    Function 00741C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00741CAB
                                                                                                                    • _wcscmp.LIBCMT ref: 00741CC0
                                                                                                                    • _wcscmp.LIBCMT ref: 00741CD7
                                                                                                                      • Part of subcall function 00736BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00736BEF
                                                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 00741D06
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 00741D11
                                                                                                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 00741D2D
                                                                                                                    • _wcscmp.LIBCMT ref: 00741D54
                                                                                                                    • _wcscmp.LIBCMT ref: 00741D6B
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00741D7D
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(007A39FC), ref: 00741D9B
                                                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 00741DA5
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 00741DB2
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 00741DC2
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                                                                                    • String ID: *.*
                                                                                                                    • API String ID: 1824444939-438819550
                                                                                                                    • Opcode ID: 3798c24ed7bef4d7d61a02d8a311de0a1e5383c59ec6ffb19955ff68d345c798
                                                                                                                    • Instruction ID: a89c7eec60c041971e60e9be8a296d76d738fa738ea8b89b08a26e81518d2ecd
                                                                                                                    • Opcode Fuzzy Hash: 3798c24ed7bef4d7d61a02d8a311de0a1e5383c59ec6ffb19955ff68d345c798
                                                                                                                    • Instruction Fuzzy Hash: 11312372A0121AAACF20BFA0DC48AEE77A89F45364F908551E905A20D1DB38DEC58E64
                                                                                                                    Function 006F7D19 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 962COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _memset
                                                                                                                    • String ID: Q\E$[$[:<:]]$[:>:]]$\$\$\$\b(?<=\w)$\b(?=\w)$]$^
                                                                                                                    • API String ID: 2102423945-2023335898
                                                                                                                    • Opcode ID: fcd280fa74b3c770ab26014146bcd6c83f04d0b67096f367991e07fec0d040da
                                                                                                                    • Instruction ID: 7ddedde729cc0e55aa92e4f43f7818a0293ea0442f7d9ac6377c28bcf4fe4e7a
                                                                                                                    • Opcode Fuzzy Hash: fcd280fa74b3c770ab26014146bcd6c83f04d0b67096f367991e07fec0d040da
                                                                                                                    • Instruction Fuzzy Hash: B5829E71D04219CBCF24CF98C8816FDBBB2BF45310F2581AAD95AAB351E7789D85CB90
                                                                                                                    Function 0074091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetLocalTime.KERNEL32(?), ref: 007409DF
                                                                                                                    • SystemTimeToFileTime.KERNEL32(?,?), ref: 007409EF
                                                                                                                    • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 007409FB
                                                                                                                    • __wsplitpath.LIBCMT ref: 00740A59
                                                                                                                    • _wcscat.LIBCMT ref: 00740A71
                                                                                                                    • _wcscat.LIBCMT ref: 00740A83
                                                                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00740A98
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00740AAC
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00740ADE
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00740AFF
                                                                                                                    • _wcscpy.LIBCMT ref: 00740B0B
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00740B4A
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
                                                                                                                    • String ID: *.*
                                                                                                                    • API String ID: 3566783562-438819550
                                                                                                                    • Opcode ID: ba9b3c9ddf2f85ec9e1208583c5c53d5a6a71d531fb51fb13010f60885973b37
                                                                                                                    • Instruction ID: 061c2bfc8560928b6e22cdf7da1705aa2e3ab8647230b16f6efb8c843c9718f9
                                                                                                                    • Opcode Fuzzy Hash: ba9b3c9ddf2f85ec9e1208583c5c53d5a6a71d531fb51fb13010f60885973b37
                                                                                                                    • Instruction Fuzzy Hash: 98617DB25043059FD710EF60C8459AEB3E9FF89310F04891EFA89D7252DB39E945CB96
                                                                                                                    Function 0072A66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0072ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0072ABD7
                                                                                                                      • Part of subcall function 0072ABBB: GetLastError.KERNEL32(?,0072A69F,?,?,?), ref: 0072ABE1
                                                                                                                      • Part of subcall function 0072ABBB: GetProcessHeap.KERNEL32(00000008,?,?,0072A69F,?,?,?), ref: 0072ABF0
                                                                                                                      • Part of subcall function 0072ABBB: HeapAlloc.KERNEL32(00000000,?,0072A69F,?,?,?), ref: 0072ABF7
                                                                                                                      • Part of subcall function 0072ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0072AC0E
                                                                                                                      • Part of subcall function 0072AC56: GetProcessHeap.KERNEL32(00000008,0072A6B5,00000000,00000000,?,0072A6B5,?), ref: 0072AC62
                                                                                                                      • Part of subcall function 0072AC56: HeapAlloc.KERNEL32(00000000,?,0072A6B5,?), ref: 0072AC69
                                                                                                                      • Part of subcall function 0072AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,0072A6B5,?), ref: 0072AC7A
                                                                                                                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0072A6D0
                                                                                                                    • _memset.LIBCMT ref: 0072A6E5
                                                                                                                    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0072A704
                                                                                                                    • GetLengthSid.ADVAPI32(?), ref: 0072A715
                                                                                                                    • GetAce.ADVAPI32(?,00000000,?), ref: 0072A752
                                                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 0072A76E
                                                                                                                    • GetLengthSid.ADVAPI32(?), ref: 0072A78B
                                                                                                                    • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 0072A79A
                                                                                                                    • HeapAlloc.KERNEL32(00000000), ref: 0072A7A1
                                                                                                                    • GetLengthSid.ADVAPI32(?,00000008,?), ref: 0072A7C2
                                                                                                                    • CopySid.ADVAPI32(00000000), ref: 0072A7C9
                                                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0072A7FA
                                                                                                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0072A820
                                                                                                                    • SetUserObjectSecurity.USER32(?,00000004,?), ref: 0072A834
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3996160137-0
                                                                                                                    • Opcode ID: a31661148f0eeb5c9c2253faeb6082a22ad7161856ec0975455c3f226d5a5da2
                                                                                                                    • Instruction ID: ec03315ace9efa855f51b39e7d6aee2fd5ee2f253b50e6b071a3b951a395db76
                                                                                                                    • Opcode Fuzzy Hash: a31661148f0eeb5c9c2253faeb6082a22ad7161856ec0975455c3f226d5a5da2
                                                                                                                    • Instruction Fuzzy Hash: D6514971900219BFDF119FA4EC44EEEBBB9FF04340F048129F915A6291DB389E46CB65
                                                                                                                    Function 006F6F07 Relevance: 20.9, Strings: 16, Instructions: 883COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: y$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$yyy y
                                                                                                                    • API String ID: 0-1554998256
                                                                                                                    • Opcode ID: cedbe709ed47a99474b3f3e6a482be01f88889a43b9ddd21a2f92f1de5ccd250
                                                                                                                    • Instruction ID: 610118c8a1be8ec1f93b1222468ec89d069d46f18e3c6f0bd57bf1e3cf1fdb96
                                                                                                                    • Opcode Fuzzy Hash: cedbe709ed47a99474b3f3e6a482be01f88889a43b9ddd21a2f92f1de5ccd250
                                                                                                                    • Instruction Fuzzy Hash: 61728071E04219DBDF24CF58C8407BEB7B6BF48350F14816AE919EB281EB749E41DB94
                                                                                                                    Function 007363F9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00736EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00735FA6,?), ref: 00736ED8
                                                                                                                      • Part of subcall function 007372CB: GetFileAttributesW.KERNEL32(?,00736019), ref: 007372CC
                                                                                                                    • _wcscat.LIBCMT ref: 00736441
                                                                                                                    • __wsplitpath.LIBCMT ref: 0073645F
                                                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 00736474
                                                                                                                    • _wcscpy.LIBCMT ref: 007364A3
                                                                                                                    • _wcscat.LIBCMT ref: 007364B8
                                                                                                                    • _wcscat.LIBCMT ref: 007364CA
                                                                                                                    • DeleteFileW.KERNEL32(?), ref: 007364DA
                                                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 007364EB
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 00736506
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
                                                                                                                    • String ID: \*.*
                                                                                                                    • API String ID: 2643075503-1173974218
                                                                                                                    • Opcode ID: e19996d19296d72a1743b3a3f9e05c360f999096e9e2775d2b7fd099acad3046
                                                                                                                    • Instruction ID: 0c0e939b37ce0c9362409a260b9c0f8f761c9ada6ae070cdba3c14861353c02d
                                                                                                                    • Opcode Fuzzy Hash: e19996d19296d72a1743b3a3f9e05c360f999096e9e2775d2b7fd099acad3046
                                                                                                                    • Instruction Fuzzy Hash: 4A31B8B2408384AED321DFA488899DBB7EC6F55300F40492AF5D8C3142EA39D54D87A7
                                                                                                                    Function 007531BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00753C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00752BB5,?,?), ref: 00753C1D
                                                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075328E
                                                                                                                      • Part of subcall function 006F936C: __swprintf.LIBCMT ref: 006F93AB
                                                                                                                      • Part of subcall function 006F936C: __itow.LIBCMT ref: 006F93DF
                                                                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0075332D
                                                                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 007533C5
                                                                                                                    • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00753604
                                                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 00753611
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1240663315-0
                                                                                                                    • Opcode ID: d041f8c21053a5891452b9e1bc0596614ec4d4620e6043ea9d240cf459ece418
                                                                                                                    • Instruction ID: b3cfbfb6746057ab0d3b2d9c4b83d28986293686c132bc705a3ccc53789b1416
                                                                                                                    • Opcode Fuzzy Hash: d041f8c21053a5891452b9e1bc0596614ec4d4620e6043ea9d240cf459ece418
                                                                                                                    • Instruction Fuzzy Hash: 10E17B31604214AFCB10DF28C995E6ABBE9FF88350F04856DF94ADB2A1DB74ED05CB51
                                                                                                                    Function 00732B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetKeyboardState.USER32(?), ref: 00732B5F
                                                                                                                    • GetAsyncKeyState.USER32(000000A0), ref: 00732BE0
                                                                                                                    • GetKeyState.USER32(000000A0), ref: 00732BFB
                                                                                                                    • GetAsyncKeyState.USER32(000000A1), ref: 00732C15
                                                                                                                    • GetKeyState.USER32(000000A1), ref: 00732C2A
                                                                                                                    • GetAsyncKeyState.USER32(00000011), ref: 00732C42
                                                                                                                    • GetKeyState.USER32(00000011), ref: 00732C54
                                                                                                                    • GetAsyncKeyState.USER32(00000012), ref: 00732C6C
                                                                                                                    • GetKeyState.USER32(00000012), ref: 00732C7E
                                                                                                                    • GetAsyncKeyState.USER32(0000005B), ref: 00732C96
                                                                                                                    • GetKeyState.USER32(0000005B), ref: 00732CA8
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: State$Async$Keyboard
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 541375521-0
                                                                                                                    • Opcode ID: 9c13e667a9250f59732b29c982f727a2ecb4611d8726f3a01bc9cc16fda9402d
                                                                                                                    • Instruction ID: 10b5ab2dfa155cbc6db61617ef19a01c1429b3ddb4f27e1f1d798d66984ec909
                                                                                                                    • Opcode Fuzzy Hash: 9c13e667a9250f59732b29c982f727a2ecb4611d8726f3a01bc9cc16fda9402d
                                                                                                                    • Instruction Fuzzy Hash: 4D4115706047C96EFF359B6488043A9FEA06F11344F08904DD9C6562C3EBAC9DD9C7B6
                                                                                                                    Function 00746D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1737998785-0
                                                                                                                    • Opcode ID: 730f6589521e2fb8af1f39c066807d78725bc003ea03cbd7cb2c7ca5f4b4539a
                                                                                                                    • Instruction ID: d8ffc9cd14840a1acca76fab2ba3a66459be161ac046bcb605b122cd9c537226
                                                                                                                    • Opcode Fuzzy Hash: 730f6589521e2fb8af1f39c066807d78725bc003ea03cbd7cb2c7ca5f4b4539a
                                                                                                                    • Instruction Fuzzy Hash: 27217C327006109FEB11AF64DC59B2D77A8EF45751F00C019F90ADB2A2DB38EC418B59
                                                                                                                    Function 0074C18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00729ABF: CLSIDFromProgID.OLE32 ref: 00729ADC
                                                                                                                      • Part of subcall function 00729ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 00729AF7
                                                                                                                      • Part of subcall function 00729ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 00729B05
                                                                                                                      • Part of subcall function 00729ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00729B15
                                                                                                                    • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 0074C235
                                                                                                                    • _memset.LIBCMT ref: 0074C242
                                                                                                                    • _memset.LIBCMT ref: 0074C360
                                                                                                                    • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 0074C38C
                                                                                                                    • CoTaskMemFree.OLE32(?), ref: 0074C397
                                                                                                                    Strings
                                                                                                                    • NULL Pointer assignment, xrefs: 0074C3E5
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                                                                                    • String ID: NULL Pointer assignment
                                                                                                                    • API String ID: 1300414916-2785691316
                                                                                                                    • Opcode ID: d8cc838477105dbc3e2d3f6a1a685086319d669cbd6a7fd446797086d3c894d7
                                                                                                                    • Instruction ID: 6a094afe18d00ee4376336d4fd3a33c8cbb6f41c9dc40ffc87119d15d8f1cb8e
                                                                                                                    • Opcode Fuzzy Hash: d8cc838477105dbc3e2d3f6a1a685086319d669cbd6a7fd446797086d3c894d7
                                                                                                                    • Instruction Fuzzy Hash: A4914C71D01218EBDB11DF94DC95EEEBBB9EF04310F10816AF519A7281DB749A45CFA0
                                                                                                                    Function 007379D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0072B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0072B180
                                                                                                                      • Part of subcall function 0072B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0072B1AD
                                                                                                                      • Part of subcall function 0072B134: GetLastError.KERNEL32 ref: 0072B1BA
                                                                                                                    • ExitWindowsEx.USER32(?,00000000), ref: 00737A0F
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                                                                    • String ID: $@$SeShutdownPrivilege
                                                                                                                    • API String ID: 2234035333-194228
                                                                                                                    • Opcode ID: 1d9500434262a41501ee37ccb8b01a486a70458fc31a6609d298f566c24c2595
                                                                                                                    • Instruction ID: 5a0f394b91b6a6b11f039eeba844cf4320e51265cad707aa07ad065b51d7558a
                                                                                                                    • Opcode Fuzzy Hash: 1d9500434262a41501ee37ccb8b01a486a70458fc31a6609d298f566c24c2595
                                                                                                                    • Instruction Fuzzy Hash: 2301A7F1759221AAF73C566C9C9BBBF72689B00781F148924F943A21D3E96D5E00C1B4
                                                                                                                    Function 00748C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00748CA8
                                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00748CB7
                                                                                                                    • bind.WSOCK32(00000000,?,00000010), ref: 00748CD3
                                                                                                                    • listen.WSOCK32(00000000,00000005), ref: 00748CE2
                                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00748CFC
                                                                                                                    • closesocket.WSOCK32(00000000,00000000), ref: 00748D10
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorLast$bindclosesocketlistensocket
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1279440585-0
                                                                                                                    • Opcode ID: f7faae3fc002ddbe88f9d784f7ee663a9d0339ca9c8422324184d80cf84bb167
                                                                                                                    • Instruction ID: 215cea5602b9dd056401f19cce7281f6fce694ecab6432c88f5f254f512b222d
                                                                                                                    • Opcode Fuzzy Hash: f7faae3fc002ddbe88f9d784f7ee663a9d0339ca9c8422324184d80cf84bb167
                                                                                                                    • Instruction Fuzzy Hash: 7421B631600105DFD754EF64CD85B6E77F9EF48350F148158F916A72D2CB38AD418BA5
                                                                                                                    Function 00736532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00736554
                                                                                                                    • Process32FirstW.KERNEL32(00000000,0000022C), ref: 00736564
                                                                                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 00736583
                                                                                                                    • __wsplitpath.LIBCMT ref: 007365A7
                                                                                                                    • _wcscat.LIBCMT ref: 007365BA
                                                                                                                    • CloseHandle.KERNEL32(00000000,?,00000000), ref: 007365F9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1605983538-0
                                                                                                                    • Opcode ID: 6d033fa8408e7e604d337e789f84f107a7f0c2b8ef610d70fc0987865f8d161b
                                                                                                                    • Instruction ID: 82ff1499e024af833ae20b02d77ae648b81aeba1d5c9ace6d755ba8e1bb122e4
                                                                                                                    • Opcode Fuzzy Hash: 6d033fa8408e7e604d337e789f84f107a7f0c2b8ef610d70fc0987865f8d161b
                                                                                                                    • Instruction Fuzzy Hash: 41215371900219EBEB20ABA4CC89BDDB7BCAB48300F5044B5E505E7141EB799FD5CBA0
                                                                                                                    Function 006F9B60 Relevance: 8.6, Strings: 6, Instructions: 1055COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: ERCP$VUUU$VUUU$VUUU$VUUU$y
                                                                                                                    • API String ID: 0-3054182913
                                                                                                                    • Opcode ID: 75f1f49dfe42d6c7feae53e1d48fa9b2f79bb9e3b1eee3e4c1d97bea5652e93a
                                                                                                                    • Instruction ID: b4ff4f228afb989d272f7436154986070d8a5c11484cf686110bb0bced3c96c9
                                                                                                                    • Opcode Fuzzy Hash: 75f1f49dfe42d6c7feae53e1d48fa9b2f79bb9e3b1eee3e4c1d97bea5652e93a
                                                                                                                    • Instruction Fuzzy Hash: 78926DB1E0021ACBDF25CF98C8407FDB7B2BB54354F1481AAD91AAB381D7759D81CBA1
                                                                                                                    Function 007313CA Relevance: 8.1, APIs: 1, Strings: 4, Instructions: 560stringCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • lstrlenW.KERNEL32(?,?,?,00000000), ref: 007313DC
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: lstrlen
                                                                                                                    • String ID: ($,2z$<2z$|
                                                                                                                    • API String ID: 1659193697-2846410172
                                                                                                                    • Opcode ID: dd356c865de6f9ac73f317f740d9d0c85592deda6210d829282694e0ff2efc42
                                                                                                                    • Instruction ID: 56c2237e4b715263d26c0339215e66f33b5e4f3f4988f4a72433d40e82393687
                                                                                                                    • Opcode Fuzzy Hash: dd356c865de6f9ac73f317f740d9d0c85592deda6210d829282694e0ff2efc42
                                                                                                                    • Instruction Fuzzy Hash: 05323475A00605DFD728CF69C480AAAB7F0FF48320B51C56EE49ADB3A2E774E941CB44
                                                                                                                    Function 0074923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0074A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 0074A84E
                                                                                                                    • socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 00749296
                                                                                                                    • WSAGetLastError.WSOCK32(00000000,00000000), ref: 007492B9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorLastinet_addrsocket
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4170576061-0
                                                                                                                    • Opcode ID: 4b21e83a57eb28366b8622ff2460842f4dbcb8b0c227444c572af53eef4fecc0
                                                                                                                    • Instruction ID: 3eefcfcab6eeaf028f9e821dfb2db5ebda5e56eadad94a2fda99f139e6bb641d
                                                                                                                    • Opcode Fuzzy Hash: 4b21e83a57eb28366b8622ff2460842f4dbcb8b0c227444c572af53eef4fecc0
                                                                                                                    • Instruction Fuzzy Hash: 9D41C071600204EFEB14AB28C846E7F77EDEF44724F04854CFA56AB2C2CB789D018BA5
                                                                                                                    Function 0073EB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0073EB8A
                                                                                                                    • _wcscmp.LIBCMT ref: 0073EBBA
                                                                                                                    • _wcscmp.LIBCMT ref: 0073EBCF
                                                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0073EBE0
                                                                                                                    • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0073EC0E
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Find$File_wcscmp$CloseFirstNext
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2387731787-0
                                                                                                                    • Opcode ID: 3af90da786df63aa1c8fa67029ff4874f709f0c76f718c3f77773512faa677a7
                                                                                                                    • Instruction ID: 7b4dbb5dadc658fdf653f615e5f79460cc7c0b07684f1c1b561d3f1ecac98caf
                                                                                                                    • Opcode Fuzzy Hash: 3af90da786df63aa1c8fa67029ff4874f709f0c76f718c3f77773512faa677a7
                                                                                                                    • Instruction Fuzzy Hash: 2241CD75604202CFD718DF28C494E9AB3E4FF49324F10465DFA5A8B3E2DB39A945CBA1
                                                                                                                    Function 00758111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 292994002-0
                                                                                                                    • Opcode ID: b2847050e40ce644c6bf82bca6ec288c378fef941711712b01d26b87f92b3e6a
                                                                                                                    • Instruction ID: 24eb1533760df3c7a6ad860a18aa3153667a147f533360f6dcb3708b0ab149e4
                                                                                                                    • Opcode Fuzzy Hash: b2847050e40ce644c6bf82bca6ec288c378fef941711712b01d26b87f92b3e6a
                                                                                                                    • Instruction Fuzzy Hash: 1011B631300519ABE7611F26DC44EAF77A9EF447A1B04441DFC49E7241CFB89D4687A6
                                                                                                                    Function 0070E01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,0070E014,771B0AE0,0070DEF1,0078DC38,?,?), ref: 0070E02C
                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0070E03E
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                                    • String ID: GetNativeSystemInfo$kernel32.dll
                                                                                                                    • API String ID: 2574300362-192647395
                                                                                                                    • Opcode ID: 7d74c1d25f278c239c63a799fba493ad66da1b15d2bd77074e76e05747176545
                                                                                                                    • Instruction ID: 351b6941de2df9a9d670fc1aa13eae59e9621e37829edc1cd678b6ffc2d5b07f
                                                                                                                    • Opcode Fuzzy Hash: 7d74c1d25f278c239c63a799fba493ad66da1b15d2bd77074e76e05747176545
                                                                                                                    • Instruction Fuzzy Hash: C5D05EF04047129EC7314B64E80861276E5AF01310F29892AA88692190D7FCC8C18750
                                                                                                                    Function 0070B11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070B34E: GetWindowLongW.USER32(?,000000EB), ref: 0070B35F
                                                                                                                    • DefDlgProcW.USER32(?,?,?,?,?), ref: 0070B22F
                                                                                                                      • Part of subcall function 0070B55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 0070B5A5
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Proc$LongWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2749884682-0
                                                                                                                    • Opcode ID: 8d2a4c420841a1d9cd9a5beba8c612b3ea91023a4704243977528eb53874c6a8
                                                                                                                    • Instruction ID: dece1fdfd1cee1c34a665133097bf56d6b9064e15d1493abec91962e397ca8de
                                                                                                                    • Opcode Fuzzy Hash: 8d2a4c420841a1d9cd9a5beba8c612b3ea91023a4704243977528eb53874c6a8
                                                                                                                    • Instruction Fuzzy Hash: CDA13770114105FADB286B2A8C9DEBF2AECFB56744B544319FC03D61D2DF5C9E019272
                                                                                                                    Function 00744EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,007443BF,00000000), ref: 00744FA6
                                                                                                                    • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00744FD2
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Internet$AvailableDataFileQueryRead
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 599397726-0
                                                                                                                    • Opcode ID: d5e4b54aed14745de34ee4ccd22e87b7f619dba769c6f5f1a69a037e9a9cc2c4
                                                                                                                    • Instruction ID: eed035aa3d0e4ac3bec3694328beac812659e3295ea34e809f587210463af55f
                                                                                                                    • Opcode Fuzzy Hash: d5e4b54aed14745de34ee4ccd22e87b7f619dba769c6f5f1a69a037e9a9cc2c4
                                                                                                                    • Instruction Fuzzy Hash: 37410575504609FFEB20CE94DC85FBFB7BCEB40758F10402AF605A6181EB799E45A7A0
                                                                                                                    Function 006F77B0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1076COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _memmove
                                                                                                                    • String ID: \Qz
                                                                                                                    • API String ID: 4104443479-2308438769
                                                                                                                    • Opcode ID: c773f938139b819f32f6ef206739981c4f918f4caec8e902987d86b091fd9142
                                                                                                                    • Instruction ID: f33ba174298c31c7d157e5dd09dcccc556ac39c7713cd4620f512790ad9db875
                                                                                                                    • Opcode Fuzzy Hash: c773f938139b819f32f6ef206739981c4f918f4caec8e902987d86b091fd9142
                                                                                                                    • Instruction Fuzzy Hash: FCA24971A04219CFDF24CF58C8806ADBBB2FF49350F2581A9D959AB391D7349E82DB90
                                                                                                                    Function 0073E1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0073E20D
                                                                                                                    • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0073E267
                                                                                                                    • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0073E2B4
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorMode$DiskFreeSpace
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1682464887-0
                                                                                                                    • Opcode ID: 76984a9e5723265bf97463c857622236bc7b1998ca68549a3987db348eb4a3b5
                                                                                                                    • Instruction ID: f96f1b01925ee7d018abf7f770ddfaeff65f5141327c6e564e742ea5ce493e5e
                                                                                                                    • Opcode Fuzzy Hash: 76984a9e5723265bf97463c857622236bc7b1998ca68549a3987db348eb4a3b5
                                                                                                                    • Instruction Fuzzy Hash: 0A216D35A00118EFDB00EFA5D885EAEBBF9FF49310F0484A9E905AB292DB359945CB54
                                                                                                                    Function 0072B134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070F4EA: std::exception::exception.LIBCMT ref: 0070F51E
                                                                                                                      • Part of subcall function 0070F4EA: __CxxThrowException@8.LIBCMT ref: 0070F533
                                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0072B180
                                                                                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0072B1AD
                                                                                                                    • GetLastError.KERNEL32 ref: 0072B1BA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1922334811-0
                                                                                                                    • Opcode ID: ba778c1cb82455aa2e4f6bb2c9e48ed8fe7ab9d42c4f1142e176bb10028f98e8
                                                                                                                    • Instruction ID: c4953f9de1051c8867851ba56122e4edd7c484c2674e7be70b93b0f269d424c8
                                                                                                                    • Opcode Fuzzy Hash: ba778c1cb82455aa2e4f6bb2c9e48ed8fe7ab9d42c4f1142e176bb10028f98e8
                                                                                                                    • Instruction Fuzzy Hash: 61119DB1400204EFE7289F64EC85D2AB7B9EF44710B20852EF45A97240DB78FC41CA60
                                                                                                                    Function 00736606 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00736623
                                                                                                                    • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00736664
                                                                                                                    • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0073666F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 33631002-0
                                                                                                                    • Opcode ID: 4954f55e5127136bdb01802ec1be6e4d02400737aeeed934035130a658779df4
                                                                                                                    • Instruction ID: 3be0199e073c0482cf6c37fdc6e3cc1ba0bacefc459d04e2fb03e2eab2edc959
                                                                                                                    • Opcode Fuzzy Hash: 4954f55e5127136bdb01802ec1be6e4d02400737aeeed934035130a658779df4
                                                                                                                    • Instruction Fuzzy Hash: 74115E71E01228BFEB108FA4DC45BAEBBBCEB45B50F108152F904E6290D3B45E018BA5
                                                                                                                    Function 007371FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00737223
                                                                                                                    • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0073723A
                                                                                                                    • FreeSid.ADVAPI32(?), ref: 0073724A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3429775523-0
                                                                                                                    • Opcode ID: 90b2dcba7005bcc8ba085ed3449be6de6f8458947e805da4917fc7569c3b515b
                                                                                                                    • Instruction ID: 23644258883f113ebfd737505d606642db7a8fdae4c5bc4a08a309cb7bef28bb
                                                                                                                    • Opcode Fuzzy Hash: 90b2dcba7005bcc8ba085ed3449be6de6f8458947e805da4917fc7569c3b515b
                                                                                                                    • Instruction Fuzzy Hash: A3F01D76A04209FFDF14DFE4DD89EEEBBB8FF08205F509469A606E2191E2749A44CB14
                                                                                                                    Function 0073F56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0073F599
                                                                                                                    • FindClose.KERNEL32(00000000), ref: 0073F5C9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Find$CloseFileFirst
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2295610775-0
                                                                                                                    • Opcode ID: cb506496ce9566fcc80c7bbe160ddd9918da24a550d8109de442f2b60ce57ddd
                                                                                                                    • Instruction ID: 835d4070e9daf619b00eee081add6f6051620ec2de2fadf2072f5a8b81476f06
                                                                                                                    • Opcode Fuzzy Hash: cb506496ce9566fcc80c7bbe160ddd9918da24a550d8109de442f2b60ce57ddd
                                                                                                                    • Instruction Fuzzy Hash: E111C432600204DFD710EF28D849E6EB3E9FF84324F00891EF9A9D7291CB34AD058B95
                                                                                                                    Function 0073CE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0074BE6A,?,?,00000000,?), ref: 0073CEA7
                                                                                                                    • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0074BE6A,?,?,00000000,?), ref: 0073CEB9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorFormatLastMessage
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3479602957-0
                                                                                                                    • Opcode ID: 7838269da5f49fff1bb983d03aecf814035fcc15833e78321ba32598200956da
                                                                                                                    • Instruction ID: f6555f47eee057ee1bff841230b4871642111c46a878ef3774705abf3a7f0556
                                                                                                                    • Opcode Fuzzy Hash: 7838269da5f49fff1bb983d03aecf814035fcc15833e78321ba32598200956da
                                                                                                                    • Instruction Fuzzy Hash: 81F0823110422DEBEB209BA4DC49FEA776DBF083A1F008165F919E6181D6749A40CBA4
                                                                                                                    Function 0073411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00734153
                                                                                                                    • keybd_event.USER32(?,75A4C0D0,?,00000000), ref: 00734166
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InputSendkeybd_event
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3536248340-0
                                                                                                                    • Opcode ID: 4deded5f2feb09563fcf4549aba4406239f2a1361f66205d2b601025ab9efa67
                                                                                                                    • Instruction ID: e5524d8411a39a253d357a172db523e4ae7ff8129676b8540a66fe7128b77c8d
                                                                                                                    • Opcode Fuzzy Hash: 4deded5f2feb09563fcf4549aba4406239f2a1361f66205d2b601025ab9efa67
                                                                                                                    • Instruction Fuzzy Hash: 06F09A7080034DAFEB058FA4C805BBE7FB0EF00305F00804AF966A6192D779DA62DFA4
                                                                                                                    Function 0072AB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,0072ACC0), ref: 0072AB99
                                                                                                                    • CloseHandle.KERNEL32(?,?,0072ACC0), ref: 0072ABAB
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AdjustCloseHandlePrivilegesToken
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 81990902-0
                                                                                                                    • Opcode ID: cf9b823b5c22977f282b2112922c1e9769af006606de9e72a9daa20e0a144b86
                                                                                                                    • Instruction ID: 9d9b238b389d49378a6acaeacece0d512ea3f083041630698c0669ee3a39e1ca
                                                                                                                    • Opcode Fuzzy Hash: cf9b823b5c22977f282b2112922c1e9769af006606de9e72a9daa20e0a144b86
                                                                                                                    • Instruction Fuzzy Hash: 74E0BF71000510EFE7352F54EC09D7677E9EF04360B108529F45981871D7665D90DB50
                                                                                                                    Function 007181AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,00716DB3,-0000031A,?,?,00000001), ref: 007181B1
                                                                                                                    • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 007181BA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ExceptionFilterUnhandled
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3192549508-0
                                                                                                                    • Opcode ID: da66ad969d4160fd22bd4991406281bb1c8c825f7ad00b06d8a46d345331d123
                                                                                                                    • Instruction ID: aa8e21b6dc8cac642929731d55e6ea260dd0baf976e2c53af5e2b4ab9d626d20
                                                                                                                    • Opcode Fuzzy Hash: da66ad969d4160fd22bd4991406281bb1c8c825f7ad00b06d8a46d345331d123
                                                                                                                    • Instruction Fuzzy Hash: E2B09231044608EBDB102BA1EC09B587FB8EF096A2F008020F60D480618B7658908AAA
                                                                                                                    Function 0071D1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 7cbafbae5f4d990538a1775040d5ffea15436fc268e8e908e0cff1ef9faf4fa2
                                                                                                                    • Instruction ID: 902b54c4aaa3f169a3704b0bb55391e6a450fec6840f9a89de9af8813b7290ca
                                                                                                                    • Opcode Fuzzy Hash: 7cbafbae5f4d990538a1775040d5ffea15436fc268e8e908e0cff1ef9faf4fa2
                                                                                                                    • Instruction Fuzzy Hash: AA321631D69F014DDB239639C922335A288EFB73D5F25D727E819B59A6EB2CC8C34604
                                                                                                                    Function 006F96C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __itow__swprintf
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 674341424-0
                                                                                                                    • Opcode ID: 2b60dea8399e90464a9ed9078ea8c73ba391ff1d91d7454c227e76d28a524718
                                                                                                                    • Instruction ID: 7afe03e4f6c50ede81bd19c21e00592b58804449b314f83358e723b2ca835ec3
                                                                                                                    • Opcode Fuzzy Hash: 2b60dea8399e90464a9ed9078ea8c73ba391ff1d91d7454c227e76d28a524718
                                                                                                                    • Instruction Fuzzy Hash: EE22C971608305DFD725DF24C881B6FB7E6AF84300F10491DFA9A9B292DB75E905CBA2
                                                                                                                    Function 0072038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 04054393260c548384184873ca71e28685503b9563c7f578e08239c1980f038f
                                                                                                                    • Instruction ID: 213c8b8753cbd4b6f25cc5a2b2f50b05d16afe1e000cb5d7c31b543948123613
                                                                                                                    • Opcode Fuzzy Hash: 04054393260c548384184873ca71e28685503b9563c7f578e08239c1980f038f
                                                                                                                    • Instruction Fuzzy Hash: 0DB11230D6AF514DD32396398831336B65CAFBB2D5FA1D71BFC2A74D22EB2585834280
                                                                                                                    Function 0073B6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __time64.LIBCMT ref: 0073B6DF
                                                                                                                      • Part of subcall function 0071344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,0073BDC3,00000000,?,?,?,?,0073BF70,00000000,?), ref: 00713453
                                                                                                                      • Part of subcall function 0071344A: __aulldiv.LIBCMT ref: 00713473
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2893107130-0
                                                                                                                    • Opcode ID: 831629bd86e17aa2d1af3e29000df5ec2f1467999b64c42c4f8af33b32ac366b
                                                                                                                    • Instruction ID: 5d72cd85055b8102bad552230158429b3e0032e6ffaead5aa7cda45e30e7de9c
                                                                                                                    • Opcode Fuzzy Hash: 831629bd86e17aa2d1af3e29000df5ec2f1467999b64c42c4f8af33b32ac366b
                                                                                                                    • Instruction Fuzzy Hash: 43216D72634510CBD729CF28C881B92B7E1EB95310B248E6DE4E5CB2C1CB78BA45DB54
                                                                                                                    Function 00746AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • BlockInput.USER32(00000001), ref: 00746ACA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: BlockInput
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3456056419-0
                                                                                                                    • Opcode ID: 5262c3482ced1f16e39dd55bd51c599e74a69f526c3726f16b0f001d1ace9430
                                                                                                                    • Instruction ID: 5828a7d06e8ea2ff17e2b6f5bc1d19e12a5a416253c81a05696e8cb3162ef3f4
                                                                                                                    • Opcode Fuzzy Hash: 5262c3482ced1f16e39dd55bd51c599e74a69f526c3726f16b0f001d1ace9430
                                                                                                                    • Instruction Fuzzy Hash: 39E01236300204AFD740EB59D404956B7EDAF65751B04C416EA49D7391DBB4F8448BA1
                                                                                                                    Function 007374E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 0073750A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: mouse_event
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2434400541-0
                                                                                                                    • Opcode ID: 7b339650f765a1cf454ba4b6f9b9ecc461aa8acc9290948e016feee1aaab8e8e
                                                                                                                    • Instruction ID: 819e4a86285d0b300211c4e30d7cccf921e4f7d4182aad34e322fb1386b57665
                                                                                                                    • Opcode Fuzzy Hash: 7b339650f765a1cf454ba4b6f9b9ecc461aa8acc9290948e016feee1aaab8e8e
                                                                                                                    • Instruction Fuzzy Hash: E7D06CE516C64969F83D07249C1BFB61A48A300782FD48589B606A90C2B8AC6D61E036
                                                                                                                    Function 0072B106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,0072AD3E), ref: 0072B124
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: LogonUser
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1244722697-0
                                                                                                                    • Opcode ID: 71f277601e1558f6f8b8729881993f1d3b6b07c1136a20fc3a0c4375232a1af8
                                                                                                                    • Instruction ID: f27a653a9b6521dc9db198967b81154a20d1c8c9223fba525cd028cfe5e227c5
                                                                                                                    • Opcode Fuzzy Hash: 71f277601e1558f6f8b8729881993f1d3b6b07c1136a20fc3a0c4375232a1af8
                                                                                                                    • Instruction Fuzzy Hash: D2D05E321A460EAEDF024FA4DC02EAE3F6AEB04700F408110FA15D50A0C675D931EB50
                                                                                                                    Function 0076B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: NameUser
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2645101109-0
                                                                                                                    • Opcode ID: 63633f18d3f963be63997786b9ac5cc0f03b9f04088b566ded363e0cae596f81
                                                                                                                    • Instruction ID: 62ec795363d1f71b81b51547b02ee88bcbe14c377bdd104b77f28e0931fa9236
                                                                                                                    • Opcode Fuzzy Hash: 63633f18d3f963be63997786b9ac5cc0f03b9f04088b566ded363e0cae596f81
                                                                                                                    • Instruction Fuzzy Hash: 5CC04CB1400509DFC751CBC0C9449EEB7BCAB04301F1050919106F1110D7749B859F76
                                                                                                                    Function 00718189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SetUnhandledExceptionFilter.KERNEL32(?), ref: 0071818F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ExceptionFilterUnhandled
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3192549508-0
                                                                                                                    • Opcode ID: d66844d3f18b35c8c1b9120ca59d9bc4b270f5b357fd20dd5d4623bb321f679e
                                                                                                                    • Instruction ID: ae8bea9e7412cac53dbed3c78e7229a3e83b0b0c1822dd91ee243c5a490ce010
                                                                                                                    • Opcode Fuzzy Hash: d66844d3f18b35c8c1b9120ca59d9bc4b270f5b357fd20dd5d4623bb321f679e
                                                                                                                    • Instruction Fuzzy Hash: 99A0113000020CEB8F002B82EC088883FACEA002A0B008020F80C080208B22A8A08AAA
                                                                                                                    Function 006F93F0 Relevance: .5, Instructions: 531COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: b0d253a11628d619da5e08813a94c8b337d47bd241179258e270c8a9d11f21c9
                                                                                                                    • Instruction ID: b8b0ef10ef17905440a3847a7d56c41f5f6c8ae6a1e16fe403899c1e348fa1c0
                                                                                                                    • Opcode Fuzzy Hash: b0d253a11628d619da5e08813a94c8b337d47bd241179258e270c8a9d11f21c9
                                                                                                                    • Instruction Fuzzy Hash: DE128D70A00609DFDF54DFA4D985ABEB7F6FF48300F108529E906E7291EB39A911CB64
                                                                                                                    Function 006FE3E3 Relevance: .5, Instructions: 521COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 7e8abf4425076aa95ed16dbb6d88dbb1adc5309c84aada08a31f4d7bcb7a1b6a
                                                                                                                    • Instruction ID: ffec261dd371bf39d7e96af7137155b03b05250a81793597fe11d9ac50c18ddd
                                                                                                                    • Opcode Fuzzy Hash: 7e8abf4425076aa95ed16dbb6d88dbb1adc5309c84aada08a31f4d7bcb7a1b6a
                                                                                                                    • Instruction Fuzzy Hash: B012C274904209CFDB24DF58C454ABEBBF2FF14304F248169EA5A9B361E736AD42CB91
                                                                                                                    Function 006FAF50 Relevance: .5, Instructions: 514COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Exception@8Throwstd::exception::exception
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3728558374-0
                                                                                                                    • Opcode ID: b524a0a9173d5d3cdfcf07f62c8f8a576f5364ab54ebf1b31dfdd317fafbaefa
                                                                                                                    • Instruction ID: ec2bb59f320c2e55982f9e8506e3d351041685ebc848d8444c8c90844ed22c52
                                                                                                                    • Opcode Fuzzy Hash: b524a0a9173d5d3cdfcf07f62c8f8a576f5364ab54ebf1b31dfdd317fafbaefa
                                                                                                                    • Instruction Fuzzy Hash: F802B070A00109DBCF54DF68D991ABEB7B6EF44300F14C069F906DB296EB38DA15CB95
                                                                                                                    Function 007102A4 Relevance: .3, Instructions: 345COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                                                                                    • Instruction ID: 3c315c64361cceead7da00cedfd9b663f5b9e9d624f69e98cb18f17377d90314
                                                                                                                    • Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                                                                                    • Instruction Fuzzy Hash: C4C1E2322051A34ADF2D463EC47447EFAE15AA2BF531A036DD8B3CB4D1EF68C5A4D660
                                                                                                                    Function 007106D9 Relevance: .3, Instructions: 341COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                                                                                    • Instruction ID: fc79c9cac6c9f8f8cdfabe6e298350a593b100af81d82cc0c3a2ced16ea1829e
                                                                                                                    • Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                                                                                    • Instruction Fuzzy Hash: 1AC1F1322091934AEF2D463EC43447EBAE15EA2BB531A036DD4B3CB4D5EF28D5A4D660
                                                                                                                    Function 0070FA57 Relevance: .3, Instructions: 323COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                                                                    • Instruction ID: 6756181fb9e5c5863599ff8cec0efe41f1dd6a0a1f9df78babd6d447ac58e5e3
                                                                                                                    • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                                                                    • Instruction Fuzzy Hash: 9DC1B23220909389DF3D8639C43443EBBE15AA2BB531A077DD4B3CB9D5EF28D564D620
                                                                                                                    Function 0074A2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • DeleteObject.GDI32(00000000), ref: 0074A2FE
                                                                                                                    • DeleteObject.GDI32(00000000), ref: 0074A310
                                                                                                                    • DestroyWindow.USER32 ref: 0074A31E
                                                                                                                    • GetDesktopWindow.USER32 ref: 0074A338
                                                                                                                    • GetWindowRect.USER32(00000000), ref: 0074A33F
                                                                                                                    • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 0074A480
                                                                                                                    • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 0074A490
                                                                                                                    • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0074A4D8
                                                                                                                    • GetClientRect.USER32(00000000,?), ref: 0074A4E4
                                                                                                                    • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0074A51E
                                                                                                                    • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0074A540
                                                                                                                    • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0074A553
                                                                                                                    • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0074A55E
                                                                                                                    • GlobalLock.KERNEL32(00000000), ref: 0074A567
                                                                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0074A576
                                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 0074A57F
                                                                                                                    • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0074A586
                                                                                                                    • GlobalFree.KERNEL32(00000000), ref: 0074A591
                                                                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0074A5A3
                                                                                                                    • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,0077D9BC,00000000), ref: 0074A5B9
                                                                                                                    • GlobalFree.KERNEL32(00000000), ref: 0074A5C9
                                                                                                                    • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 0074A5EF
                                                                                                                    • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 0074A60E
                                                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0074A630
                                                                                                                    • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0074A81D
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                                                                    • String ID: $AutoIt v3$DISPLAY$static
                                                                                                                    • API String ID: 2211948467-2373415609
                                                                                                                    • Opcode ID: 2e2a646bafa630ad14846de626d204017447c6de94b55938c3f0a3a36e895b59
                                                                                                                    • Instruction ID: 420070b8372174da8ee94de4d046aa3ac3772eadcd908b8cbd0373e1d97c2214
                                                                                                                    • Opcode Fuzzy Hash: 2e2a646bafa630ad14846de626d204017447c6de94b55938c3f0a3a36e895b59
                                                                                                                    • Instruction Fuzzy Hash: D3025D71900108EFDB14DFA8CD89EAE7BB9FF49350F108158F909AB2A1D778AD41CB64
                                                                                                                    Function 0075D285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SetTextColor.GDI32(?,00000000), ref: 0075D2DB
                                                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 0075D30C
                                                                                                                    • GetSysColor.USER32(0000000F), ref: 0075D318
                                                                                                                    • SetBkColor.GDI32(?,000000FF), ref: 0075D332
                                                                                                                    • SelectObject.GDI32(?,00000000), ref: 0075D341
                                                                                                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 0075D36C
                                                                                                                    • GetSysColor.USER32(00000010), ref: 0075D374
                                                                                                                    • CreateSolidBrush.GDI32(00000000), ref: 0075D37B
                                                                                                                    • FrameRect.USER32(?,?,00000000), ref: 0075D38A
                                                                                                                    • DeleteObject.GDI32(00000000), ref: 0075D391
                                                                                                                    • InflateRect.USER32(?,000000FE,000000FE), ref: 0075D3DC
                                                                                                                    • FillRect.USER32(?,?,00000000), ref: 0075D40E
                                                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 0075D439
                                                                                                                      • Part of subcall function 0075D575: GetSysColor.USER32(00000012), ref: 0075D5AE
                                                                                                                      • Part of subcall function 0075D575: SetTextColor.GDI32(?,?), ref: 0075D5B2
                                                                                                                      • Part of subcall function 0075D575: GetSysColorBrush.USER32(0000000F), ref: 0075D5C8
                                                                                                                      • Part of subcall function 0075D575: GetSysColor.USER32(0000000F), ref: 0075D5D3
                                                                                                                      • Part of subcall function 0075D575: GetSysColor.USER32(00000011), ref: 0075D5F0
                                                                                                                      • Part of subcall function 0075D575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0075D5FE
                                                                                                                      • Part of subcall function 0075D575: SelectObject.GDI32(?,00000000), ref: 0075D60F
                                                                                                                      • Part of subcall function 0075D575: SetBkColor.GDI32(?,00000000), ref: 0075D618
                                                                                                                      • Part of subcall function 0075D575: SelectObject.GDI32(?,?), ref: 0075D625
                                                                                                                      • Part of subcall function 0075D575: InflateRect.USER32(?,000000FF,000000FF), ref: 0075D644
                                                                                                                      • Part of subcall function 0075D575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0075D65B
                                                                                                                      • Part of subcall function 0075D575: GetWindowLongW.USER32(00000000,000000F0), ref: 0075D670
                                                                                                                      • Part of subcall function 0075D575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0075D698
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3521893082-0
                                                                                                                    • Opcode ID: 5af6c8d9859565b20f3b0bb115ef1f643252c46075302f908bc21b169561af72
                                                                                                                    • Instruction ID: cba0fe2b3cef790a1d49ff648244925492993d40df23a44b8f487313f20bdffa
                                                                                                                    • Opcode Fuzzy Hash: 5af6c8d9859565b20f3b0bb115ef1f643252c46075302f908bc21b169561af72
                                                                                                                    • Instruction Fuzzy Hash: 9F919E71008305EFCB209F64DC08AAB7BB9FF89361F108A19F966961A0D779DD84CB56
                                                                                                                    Function 0070B8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • DestroyWindow.USER32 ref: 0070B98B
                                                                                                                    • DeleteObject.GDI32(00000000), ref: 0070B9CD
                                                                                                                    • DeleteObject.GDI32(00000000), ref: 0070B9D8
                                                                                                                    • DestroyIcon.USER32(00000000), ref: 0070B9E3
                                                                                                                    • DestroyWindow.USER32(00000000), ref: 0070B9EE
                                                                                                                    • SendMessageW.USER32(?,00001308,?,00000000), ref: 0076D2AA
                                                                                                                    • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0076D2E3
                                                                                                                    • MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 0076D711
                                                                                                                      • Part of subcall function 0070B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,0070B759,?,00000000,?,?,?,?,0070B72B,00000000,?), ref: 0070BA58
                                                                                                                    • SendMessageW.USER32 ref: 0076D758
                                                                                                                    • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0076D76F
                                                                                                                    • ImageList_Destroy.COMCTL32(00000000), ref: 0076D785
                                                                                                                    • ImageList_Destroy.COMCTL32(00000000), ref: 0076D790
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                                                                                    • String ID: 0
                                                                                                                    • API String ID: 464785882-4108050209
                                                                                                                    • Opcode ID: 68b7f790c3fa30dd643353347005f09a4d20365c3cdffd758df61ed1f2d0c21b
                                                                                                                    • Instruction ID: 4810dfca06aaf347e5f365d830a69f17998656a9cca35eaafcc024c754814cca
                                                                                                                    • Opcode Fuzzy Hash: 68b7f790c3fa30dd643353347005f09a4d20365c3cdffd758df61ed1f2d0c21b
                                                                                                                    • Instruction Fuzzy Hash: DE12A070A14241DFDB21CF28C888BA9BBF5FF05304F144569E98ACB692C739ED95CB91
                                                                                                                    Function 0073DBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0073DBD6
                                                                                                                    • GetDriveTypeW.KERNEL32(?,0078DC54,?,\\.\,0078DC00), ref: 0073DCC3
                                                                                                                    • SetErrorMode.KERNEL32(00000000,0078DC54,?,\\.\,0078DC00), ref: 0073DE29
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorMode$DriveType
                                                                                                                    • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                                                                    • API String ID: 2907320926-4222207086
                                                                                                                    • Opcode ID: 83ba98d39ba1a010945f561943f7cf50472002c0cdbe89c2f806311b3c59e7f6
                                                                                                                    • Instruction ID: a852b04a31a27378b7f2f99abbfde9a07d1ec126d289bb042e3765de5c1e512c
                                                                                                                    • Opcode Fuzzy Hash: 83ba98d39ba1a010945f561943f7cf50472002c0cdbe89c2f806311b3c59e7f6
                                                                                                                    • Instruction Fuzzy Hash: 9951D1B0358306EBD220EF10E882879B7A6FB95B54F104A1EF0079B297CB6CDD45DB52
                                                                                                                    Function 006FCC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __wcsnicmp
                                                                                                                    • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                                                                    • API String ID: 1038674560-86951937
                                                                                                                    • Opcode ID: 1a3037ef51245d3666d48e241f7ce08913edb7f902fb65bcf4e8fb7da6a4f564
                                                                                                                    • Instruction ID: 99d54406d5bd748bd1de52e74e8c085be44e2d4542f077ce04478e934ef4fefa
                                                                                                                    • Opcode Fuzzy Hash: 1a3037ef51245d3666d48e241f7ce08913edb7f902fb65bcf4e8fb7da6a4f564
                                                                                                                    • Instruction Fuzzy Hash: 1381F87064060DAACB60BB64CD56FFF7769AF14320F044029FE06AA1C3EB69D942C6A5
                                                                                                                    Function 0075C6E9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 0075C788
                                                                                                                    • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0075C83E
                                                                                                                    • SendMessageW.USER32(?,00001102,00000002,?), ref: 0075C859
                                                                                                                    • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0075CB15
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$Window
                                                                                                                    • String ID: 0
                                                                                                                    • API String ID: 2326795674-4108050209
                                                                                                                    • Opcode ID: fd93f4b593acaab655ba9c17bdaabf1919e43200ed6f5a9d4660882850fd6292
                                                                                                                    • Instruction ID: 49fbfb3aff168cef2d9d5f0776c8315a566072d311c136b1eccbc41f4081de66
                                                                                                                    • Opcode Fuzzy Hash: fd93f4b593acaab655ba9c17bdaabf1919e43200ed6f5a9d4660882850fd6292
                                                                                                                    • Instruction Fuzzy Hash: 2BF1C071104301AFD7228F24CC89BEABBE4FF49356F08461DF999D62A1C7B8D949CB91
                                                                                                                    Function 0075638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CharUpperBuffW.USER32(?,?,0078DC00), ref: 00756449
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: BuffCharUpper
                                                                                                                    • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                                                                                    • API String ID: 3964851224-45149045
                                                                                                                    • Opcode ID: 671dacb9d51a5293918057a1db5a4b2c67c0f6c5ab5d7bab00199575a4d71bf0
                                                                                                                    • Instruction ID: bdc5e57eba441661359959a8e6c4f79be96193a803190ee1f71cd0322a1d3e10
                                                                                                                    • Opcode Fuzzy Hash: 671dacb9d51a5293918057a1db5a4b2c67c0f6c5ab5d7bab00199575a4d71bf0
                                                                                                                    • Instruction Fuzzy Hash: 09C19F30204245CBCB04EF10C555AAE77E2AF95345F40496CFC865B2E2EBADED4ECB92
                                                                                                                    Function 0075D575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetSysColor.USER32(00000012), ref: 0075D5AE
                                                                                                                    • SetTextColor.GDI32(?,?), ref: 0075D5B2
                                                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 0075D5C8
                                                                                                                    • GetSysColor.USER32(0000000F), ref: 0075D5D3
                                                                                                                    • CreateSolidBrush.GDI32(?), ref: 0075D5D8
                                                                                                                    • GetSysColor.USER32(00000011), ref: 0075D5F0
                                                                                                                    • CreatePen.GDI32(00000000,00000001,00743C00), ref: 0075D5FE
                                                                                                                    • SelectObject.GDI32(?,00000000), ref: 0075D60F
                                                                                                                    • SetBkColor.GDI32(?,00000000), ref: 0075D618
                                                                                                                    • SelectObject.GDI32(?,?), ref: 0075D625
                                                                                                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 0075D644
                                                                                                                    • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0075D65B
                                                                                                                    • GetWindowLongW.USER32(00000000,000000F0), ref: 0075D670
                                                                                                                    • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0075D698
                                                                                                                    • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0075D6BF
                                                                                                                    • InflateRect.USER32(?,000000FD,000000FD), ref: 0075D6DD
                                                                                                                    • DrawFocusRect.USER32(?,?), ref: 0075D6E8
                                                                                                                    • GetSysColor.USER32(00000011), ref: 0075D6F6
                                                                                                                    • SetTextColor.GDI32(?,00000000), ref: 0075D6FE
                                                                                                                    • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0075D712
                                                                                                                    • SelectObject.GDI32(?,0075D2A5), ref: 0075D729
                                                                                                                    • DeleteObject.GDI32(?), ref: 0075D734
                                                                                                                    • SelectObject.GDI32(?,?), ref: 0075D73A
                                                                                                                    • DeleteObject.GDI32(?), ref: 0075D73F
                                                                                                                    • SetTextColor.GDI32(?,?), ref: 0075D745
                                                                                                                    • SetBkColor.GDI32(?,?), ref: 0075D74F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1996641542-0
                                                                                                                    • Opcode ID: 956cd63e9a2f280df1ce71cd83450b290d6f8e52aba00df1a6b5d4baf5bbf81b
                                                                                                                    • Instruction ID: 18e14f5ab522aa50d8d2d34b5242d54054459276dcc3c2d31a52d261a1dfba1c
                                                                                                                    • Opcode Fuzzy Hash: 956cd63e9a2f280df1ce71cd83450b290d6f8e52aba00df1a6b5d4baf5bbf81b
                                                                                                                    • Instruction Fuzzy Hash: 8F513D71900208AFDB209FA4DC48EEE7B79EF08365F118515F919AB2A1D7B99E80CF50
                                                                                                                    Function 0075B6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0075B7B0
                                                                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0075B7C1
                                                                                                                    • CharNextW.USER32(0000014E), ref: 0075B7F0
                                                                                                                    • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 0075B831
                                                                                                                    • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 0075B847
                                                                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0075B858
                                                                                                                    • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 0075B875
                                                                                                                    • SetWindowTextW.USER32(?,0000014E), ref: 0075B8C7
                                                                                                                    • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 0075B8DD
                                                                                                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 0075B90E
                                                                                                                    • _memset.LIBCMT ref: 0075B933
                                                                                                                    • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 0075B97C
                                                                                                                    • _memset.LIBCMT ref: 0075B9DB
                                                                                                                    • SendMessageW.USER32 ref: 0075BA05
                                                                                                                    • SendMessageW.USER32(?,00001074,?,00000001), ref: 0075BA5D
                                                                                                                    • SendMessageW.USER32(?,0000133D,?,?), ref: 0075BB0A
                                                                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 0075BB2C
                                                                                                                    • GetMenuItemInfoW.USER32(?), ref: 0075BB76
                                                                                                                    • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0075BBA3
                                                                                                                    • DrawMenuBar.USER32(?), ref: 0075BBB2
                                                                                                                    • SetWindowTextW.USER32(?,0000014E), ref: 0075BBDA
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                                                                                    • String ID: 0
                                                                                                                    • API String ID: 1073566785-4108050209
                                                                                                                    • Opcode ID: 5cccd5d50126468b5c1d4ce8983085c2d61c960764653fb46294475b97e20f3f
                                                                                                                    • Instruction ID: 9815e322db96a221ad387626a07c0f0ef3d4fbff4a68dcae2fd90802cc7fa331
                                                                                                                    • Opcode Fuzzy Hash: 5cccd5d50126468b5c1d4ce8983085c2d61c960764653fb46294475b97e20f3f
                                                                                                                    • Instruction Fuzzy Hash: 57E18EB1900218EFDB209F65CC84EFE7B78EF05755F108156FD19AA190DBB89A89CF60
                                                                                                                    Function 006F2EC0 Relevance: 37.1, APIs: 8, Strings: 13, Instructions: 346COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$Foreground
                                                                                                                    • String ID: ACTIVE$ALL$CLASS$H+z$HANDLE$INSTANCE$L+z$LAST$P+z$REGEXPCLASS$REGEXPTITLE$T+z$TITLE
                                                                                                                    • API String ID: 62970417-2125560328
                                                                                                                    • Opcode ID: f8fc1154d8728b1850fe6c5d24cfc7eed8c2dd6a9d1f863340bbaf1b32e5fc2f
                                                                                                                    • Instruction ID: 4108500857726b89eeb420387c63cac4598364bd1daf58527fa8e0186569971b
                                                                                                                    • Opcode Fuzzy Hash: f8fc1154d8728b1850fe6c5d24cfc7eed8c2dd6a9d1f863340bbaf1b32e5fc2f
                                                                                                                    • Instruction Fuzzy Hash: C2D1E730108646EFCB44EF14C8519AABBB1BF54340F004A1DF957575A3DB38E99BCBA1
                                                                                                                    Function 0075764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetCursorPos.USER32(?), ref: 0075778A
                                                                                                                    • GetDesktopWindow.USER32 ref: 0075779F
                                                                                                                    • GetWindowRect.USER32(00000000), ref: 007577A6
                                                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 00757808
                                                                                                                    • DestroyWindow.USER32(?), ref: 00757834
                                                                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0075785D
                                                                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0075787B
                                                                                                                    • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 007578A1
                                                                                                                    • SendMessageW.USER32(?,00000421,?,?), ref: 007578B6
                                                                                                                    • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 007578C9
                                                                                                                    • IsWindowVisible.USER32(?), ref: 007578E9
                                                                                                                    • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00757904
                                                                                                                    • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00757918
                                                                                                                    • GetWindowRect.USER32(?,?), ref: 00757930
                                                                                                                    • MonitorFromPoint.USER32(?,?,00000002), ref: 00757956
                                                                                                                    • GetMonitorInfoW.USER32 ref: 00757970
                                                                                                                    • CopyRect.USER32(?,?), ref: 00757987
                                                                                                                    • SendMessageW.USER32(?,00000412,00000000), ref: 007579F2
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                                                                    • String ID: ($0$tooltips_class32
                                                                                                                    • API String ID: 698492251-4156429822
                                                                                                                    • Opcode ID: 38185ab4f92bfe37344aaab2923ba9a48dd45ff37282cb900ac6d0617f1b1fea
                                                                                                                    • Instruction ID: edf0b7a2141f06655dcb277c9dfab7e024578b92fccd6d3b24282be6690161af
                                                                                                                    • Opcode Fuzzy Hash: 38185ab4f92bfe37344aaab2923ba9a48dd45ff37282cb900ac6d0617f1b1fea
                                                                                                                    • Instruction Fuzzy Hash: F0B1B071608300AFD754DF64D848BAABBE5FF88351F00891DF9899B291D7B4EC48CB95
                                                                                                                    Function 00736CE9 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00736CFB
                                                                                                                    • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00736D21
                                                                                                                    • _wcscpy.LIBCMT ref: 00736D4F
                                                                                                                    • _wcscmp.LIBCMT ref: 00736D5A
                                                                                                                    • _wcscat.LIBCMT ref: 00736D70
                                                                                                                    • _wcsstr.LIBCMT ref: 00736D7B
                                                                                                                    • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00736D97
                                                                                                                    • _wcscat.LIBCMT ref: 00736DE0
                                                                                                                    • _wcscat.LIBCMT ref: 00736DE7
                                                                                                                    • _wcsncpy.LIBCMT ref: 00736E12
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
                                                                                                                    • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                                    • API String ID: 699586101-1459072770
                                                                                                                    • Opcode ID: f84ab8ecc38ee7857a03b277d90f69f54cd3d8fbc2fa29178ad869ecdf9ad828
                                                                                                                    • Instruction ID: 2b650cc31dbe4951cbdfb62b6cd46cf1b2e9a0eadb5c8f8e83a4c63725ad6785
                                                                                                                    • Opcode Fuzzy Hash: f84ab8ecc38ee7857a03b277d90f69f54cd3d8fbc2fa29178ad869ecdf9ad828
                                                                                                                    • Instruction Fuzzy Hash: 9341C272640204FBEB10AB688C4BEFF77BCEF41710F144169F905A61C2EABC9A5196A5
                                                                                                                    Function 0070A856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0070A939
                                                                                                                    • GetSystemMetrics.USER32(00000007), ref: 0070A941
                                                                                                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0070A96C
                                                                                                                    • GetSystemMetrics.USER32(00000008), ref: 0070A974
                                                                                                                    • GetSystemMetrics.USER32(00000004), ref: 0070A999
                                                                                                                    • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 0070A9B6
                                                                                                                    • AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 0070A9C6
                                                                                                                    • CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0070A9F9
                                                                                                                    • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 0070AA0D
                                                                                                                    • GetClientRect.USER32(00000000,000000FF), ref: 0070AA2B
                                                                                                                    • GetStockObject.GDI32(00000011), ref: 0070AA47
                                                                                                                    • SendMessageW.USER32(00000000,00000030,00000000), ref: 0070AA52
                                                                                                                      • Part of subcall function 0070B63C: GetCursorPos.USER32(000000FF), ref: 0070B64F
                                                                                                                      • Part of subcall function 0070B63C: ScreenToClient.USER32(00000000,000000FF), ref: 0070B66C
                                                                                                                      • Part of subcall function 0070B63C: GetAsyncKeyState.USER32(00000001), ref: 0070B691
                                                                                                                      • Part of subcall function 0070B63C: GetAsyncKeyState.USER32(00000002), ref: 0070B69F
                                                                                                                    • SetTimer.USER32(00000000,00000000,00000028,0070AB87), ref: 0070AA79
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                                                                    • String ID: AutoIt v3 GUI
                                                                                                                    • API String ID: 1458621304-248962490
                                                                                                                    • Opcode ID: 44f550905e915118e5b3502581ca26c09aa818b9941b57d81977063e25e29227
                                                                                                                    • Instruction ID: ee682aa710b7a3df2f1ab3d4714f7deb35ae2457b2be18224fbe35e035e14df7
                                                                                                                    • Opcode Fuzzy Hash: 44f550905e915118e5b3502581ca26c09aa818b9941b57d81977063e25e29227
                                                                                                                    • Instruction Fuzzy Hash: 8BB15F71A0020AEFDB14DFA8CC59BAD7BB4FF08354F118229FA15A62D0DB78AC40CB55
                                                                                                                    Function 00753639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00753735
                                                                                                                    • RegCreateKeyExW.ADVAPI32(?,?,00000000,0078DC00,00000000,?,00000000,?,?), ref: 007537A3
                                                                                                                    • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 007537EB
                                                                                                                    • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00753874
                                                                                                                    • RegCloseKey.ADVAPI32(?), ref: 00753B94
                                                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 00753BA1
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Close$ConnectCreateRegistryValue
                                                                                                                    • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                                                                    • API String ID: 536824911-966354055
                                                                                                                    • Opcode ID: ae5ba58efdccbd8823005e082e4c07ee27b984738bec91fed118da60b8538f44
                                                                                                                    • Instruction ID: 65db3b6f8dca7dc60c6e5630b418b12e60005f4ca16e5b5af33e3f3eddaa6a32
                                                                                                                    • Opcode Fuzzy Hash: ae5ba58efdccbd8823005e082e4c07ee27b984738bec91fed118da60b8538f44
                                                                                                                    • Instruction Fuzzy Hash: 2B027876200601DFCB14EF14C885E6AB7E5FF89720F04855CF98A9B2A2CB74ED45CB95
                                                                                                                    Function 00756BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CharUpperBuffW.USER32(?,?), ref: 00756C56
                                                                                                                    • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00756D16
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: BuffCharMessageSendUpper
                                                                                                                    • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                                                                                    • API String ID: 3974292440-719923060
                                                                                                                    • Opcode ID: c8fa29e10f86363f9d48f8408aaf9c8c9a126b008b0688e8f37bd3480c9ff7e7
                                                                                                                    • Instruction ID: aa83ae6e6a4594af169348c442d21df8f5afff895ea101087dfcccebd26b4609
                                                                                                                    • Opcode Fuzzy Hash: c8fa29e10f86363f9d48f8408aaf9c8c9a126b008b0688e8f37bd3480c9ff7e7
                                                                                                                    • Instruction Fuzzy Hash: 26A19D30204345DBCB14EF20C856AABB3A2BF84311F504A6DB9565B3D2DB79ED0ACB91
                                                                                                                    Function 0072CF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 0072CF91
                                                                                                                    • __swprintf.LIBCMT ref: 0072D032
                                                                                                                    • _wcscmp.LIBCMT ref: 0072D045
                                                                                                                    • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0072D09A
                                                                                                                    • _wcscmp.LIBCMT ref: 0072D0D6
                                                                                                                    • GetClassNameW.USER32(?,?,00000400), ref: 0072D10D
                                                                                                                    • GetDlgCtrlID.USER32(?), ref: 0072D15F
                                                                                                                    • GetWindowRect.USER32(?,?), ref: 0072D195
                                                                                                                    • GetParent.USER32(?), ref: 0072D1B3
                                                                                                                    • ScreenToClient.USER32(00000000), ref: 0072D1BA
                                                                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 0072D234
                                                                                                                    • _wcscmp.LIBCMT ref: 0072D248
                                                                                                                    • GetWindowTextW.USER32(?,?,00000400), ref: 0072D26E
                                                                                                                    • _wcscmp.LIBCMT ref: 0072D282
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
                                                                                                                    • String ID: %s%u
                                                                                                                    • API String ID: 3119225716-679674701
                                                                                                                    • Opcode ID: 9b28a1893cd35a59542530afaf63154d5531fbbed64ac7c2563999a6a187031f
                                                                                                                    • Instruction ID: 369d8b535b8c971492de05255f73f57be301ec8889117258d6cc914a3c77e551
                                                                                                                    • Opcode Fuzzy Hash: 9b28a1893cd35a59542530afaf63154d5531fbbed64ac7c2563999a6a187031f
                                                                                                                    • Instruction Fuzzy Hash: 37A1F031204316EFD725DF64D884BAAB7E8FF48354F008519FA99D2190DB38EE55CBA1
                                                                                                                    Function 0072D8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetClassNameW.USER32(00000008,?,00000400), ref: 0072D8EB
                                                                                                                    • _wcscmp.LIBCMT ref: 0072D8FC
                                                                                                                    • GetWindowTextW.USER32(00000001,?,00000400), ref: 0072D924
                                                                                                                    • CharUpperBuffW.USER32(?,00000000), ref: 0072D941
                                                                                                                    • _wcscmp.LIBCMT ref: 0072D95F
                                                                                                                    • _wcsstr.LIBCMT ref: 0072D970
                                                                                                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 0072D9A8
                                                                                                                    • _wcscmp.LIBCMT ref: 0072D9B8
                                                                                                                    • GetWindowTextW.USER32(00000002,?,00000400), ref: 0072D9DF
                                                                                                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 0072DA28
                                                                                                                    • _wcscmp.LIBCMT ref: 0072DA38
                                                                                                                    • GetClassNameW.USER32(00000010,?,00000400), ref: 0072DA60
                                                                                                                    • GetWindowRect.USER32(00000004,?), ref: 0072DAC9
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                                                                                    • String ID: @$ThumbnailClass
                                                                                                                    • API String ID: 1788623398-1539354611
                                                                                                                    • Opcode ID: 6f14ec1c3a6f6abce7498638204a36717e4a4ad202962e9859ed989d3e1e499a
                                                                                                                    • Instruction ID: d8431bb953332d0eea45e6a421c31189814eb30e026ab01e802c2a99784fbe7e
                                                                                                                    • Opcode Fuzzy Hash: 6f14ec1c3a6f6abce7498638204a36717e4a4ad202962e9859ed989d3e1e499a
                                                                                                                    • Instruction Fuzzy Hash: DC81F6710083559FDB20CF14D885FAA7BE8FF44354F04846AFD899A096DB38ED85CBA1
                                                                                                                    Function 0072D6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __wcsnicmp
                                                                                                                    • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                                                                    • API String ID: 1038674560-1810252412
                                                                                                                    • Opcode ID: 7fbae91dc051f4d5b8abf9f120eb9f4b4f2f49bde2d90c10a220c40d52f7275a
                                                                                                                    • Instruction ID: fa4fc8a727023519fac5de02d2750fe5c82f99924d7081bd04ca56923d0ea12d
                                                                                                                    • Opcode Fuzzy Hash: 7fbae91dc051f4d5b8abf9f120eb9f4b4f2f49bde2d90c10a220c40d52f7275a
                                                                                                                    • Instruction Fuzzy Hash: 4B31B0B1644209E7DB24FA58ED53EFDB3B69F21710F200229F501B10D2FB69AE45C665
                                                                                                                    Function 0072EA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadIconW.USER32(00000063), ref: 0072EAB0
                                                                                                                    • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0072EAC2
                                                                                                                    • SetWindowTextW.USER32(?,?), ref: 0072EAD9
                                                                                                                    • GetDlgItem.USER32(?,000003EA), ref: 0072EAEE
                                                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 0072EAF4
                                                                                                                    • GetDlgItem.USER32(?,000003E9), ref: 0072EB04
                                                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 0072EB0A
                                                                                                                    • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0072EB2B
                                                                                                                    • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0072EB45
                                                                                                                    • GetWindowRect.USER32(?,?), ref: 0072EB4E
                                                                                                                    • SetWindowTextW.USER32(?,?), ref: 0072EBB9
                                                                                                                    • GetDesktopWindow.USER32 ref: 0072EBBF
                                                                                                                    • GetWindowRect.USER32(00000000), ref: 0072EBC6
                                                                                                                    • MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0072EC12
                                                                                                                    • GetClientRect.USER32(?,?), ref: 0072EC1F
                                                                                                                    • PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0072EC44
                                                                                                                    • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0072EC6F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3869813825-0
                                                                                                                    • Opcode ID: f9ab27a66ce294ace2b8828e69fbc932f0418e0df14a20dbee79694d6cdaae64
                                                                                                                    • Instruction ID: f7f7f1b7358aa8d6af69175e5942638a11d13e2f43f074433834fb2f51ddbe7e
                                                                                                                    • Opcode Fuzzy Hash: f9ab27a66ce294ace2b8828e69fbc932f0418e0df14a20dbee79694d6cdaae64
                                                                                                                    • Instruction Fuzzy Hash: 55514A71900709EFDB20DFA8DD89F6EBBB5FF04745F008928E686A25A0D778AD44CB10
                                                                                                                    Function 007479B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadCursorW.USER32(00000000,00007F8A), ref: 007479C6
                                                                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 007479D1
                                                                                                                    • LoadCursorW.USER32(00000000,00007F03), ref: 007479DC
                                                                                                                    • LoadCursorW.USER32(00000000,00007F8B), ref: 007479E7
                                                                                                                    • LoadCursorW.USER32(00000000,00007F01), ref: 007479F2
                                                                                                                    • LoadCursorW.USER32(00000000,00007F81), ref: 007479FD
                                                                                                                    • LoadCursorW.USER32(00000000,00007F88), ref: 00747A08
                                                                                                                    • LoadCursorW.USER32(00000000,00007F80), ref: 00747A13
                                                                                                                    • LoadCursorW.USER32(00000000,00007F86), ref: 00747A1E
                                                                                                                    • LoadCursorW.USER32(00000000,00007F83), ref: 00747A29
                                                                                                                    • LoadCursorW.USER32(00000000,00007F85), ref: 00747A34
                                                                                                                    • LoadCursorW.USER32(00000000,00007F82), ref: 00747A3F
                                                                                                                    • LoadCursorW.USER32(00000000,00007F84), ref: 00747A4A
                                                                                                                    • LoadCursorW.USER32(00000000,00007F04), ref: 00747A55
                                                                                                                    • LoadCursorW.USER32(00000000,00007F02), ref: 00747A60
                                                                                                                    • LoadCursorW.USER32(00000000,00007F89), ref: 00747A6B
                                                                                                                    • GetCursorInfo.USER32(?), ref: 00747A7B
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Cursor$Load$Info
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2577412497-0
                                                                                                                    • Opcode ID: b1536b5c1ecb569dadbe6e3902aa99814336b9fee799c25658fe5a2110f21627
                                                                                                                    • Instruction ID: 75c8d5c5ce1d806e0b9d9824c606f69fc60d53f1e241e4f95d473b483f475ae6
                                                                                                                    • Opcode Fuzzy Hash: b1536b5c1ecb569dadbe6e3902aa99814336b9fee799c25658fe5a2110f21627
                                                                                                                    • Instruction Fuzzy Hash: BF31F8B1E48319AADB109FB68C8995FBEE8FF04750F504526E50DE7281DB7C6501CFA1
                                                                                                                    Function 006FC833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070E968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,006FC8B7,?,00002000,?,?,00000000,?,006F419E,?,?,?,0078DC00), ref: 0070E984
                                                                                                                      • Part of subcall function 006F660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006F53B1,?,?,006F61FF,?,00000000,00000001,00000000), ref: 006F662F
                                                                                                                    • __wsplitpath.LIBCMT ref: 006FC93E
                                                                                                                      • Part of subcall function 00711DFC: __wsplitpath_helper.LIBCMT ref: 00711E3C
                                                                                                                    • _wcscpy.LIBCMT ref: 006FC953
                                                                                                                    • _wcscat.LIBCMT ref: 006FC968
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 006FC978
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 006FCABE
                                                                                                                      • Part of subcall function 006FB337: _wcscpy.LIBCMT ref: 006FB36F
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                    • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                                                                                    • API String ID: 2258743419-1018226102
                                                                                                                    • Opcode ID: 41b47b9760a0ba94bc2bc6d522de955674b4bdb29ff054f1b42b4849394800cd
                                                                                                                    • Instruction ID: 1513ab8ed0bd5c77db0746baf6721a0d1c17c5418fb2cc3f992a2f75046a6a01
                                                                                                                    • Opcode Fuzzy Hash: 41b47b9760a0ba94bc2bc6d522de955674b4bdb29ff054f1b42b4849394800cd
                                                                                                                    • Instruction Fuzzy Hash: 9712B171508349DFC724EF24C981AAFBBE5BF99314F00491DF68A93292DB34DA49CB52
                                                                                                                    Function 0075CE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 0075CEFB
                                                                                                                    • DestroyWindow.USER32(?,?), ref: 0075CF73
                                                                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0075CFF4
                                                                                                                    • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0075D016
                                                                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0075D025
                                                                                                                    • DestroyWindow.USER32(?), ref: 0075D042
                                                                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,006F0000,00000000), ref: 0075D075
                                                                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0075D094
                                                                                                                    • GetDesktopWindow.USER32 ref: 0075D0A9
                                                                                                                    • GetWindowRect.USER32(00000000), ref: 0075D0B0
                                                                                                                    • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0075D0C2
                                                                                                                    • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0075D0DA
                                                                                                                      • Part of subcall function 0070B526: GetWindowLongW.USER32(?,000000EB), ref: 0070B537
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
                                                                                                                    • String ID: 0$tooltips_class32
                                                                                                                    • API String ID: 3877571568-3619404913
                                                                                                                    • Opcode ID: fadfbcafa30c23e6f299acb07cffed0090ef7d552a1948cd168236fb9c02a720
                                                                                                                    • Instruction ID: 9ebcf3b3b3510340a81e15dd7bbf5815ea6f428b275860e7e58480213dfb3d44
                                                                                                                    • Opcode Fuzzy Hash: fadfbcafa30c23e6f299acb07cffed0090ef7d552a1948cd168236fb9c02a720
                                                                                                                    • Instruction Fuzzy Hash: 9F71AC70140209AFD730CF28CC84FA637E5EB88748F54851DF9898B2A1DBB8ED46CB56
                                                                                                                    Function 0075F351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070B34E: GetWindowLongW.USER32(?,000000EB), ref: 0070B35F
                                                                                                                    • DragQueryPoint.SHELL32(?,?), ref: 0075F37A
                                                                                                                      • Part of subcall function 0075D7DE: ClientToScreen.USER32(?,?), ref: 0075D807
                                                                                                                      • Part of subcall function 0075D7DE: GetWindowRect.USER32(?,?), ref: 0075D87D
                                                                                                                      • Part of subcall function 0075D7DE: PtInRect.USER32(?,?,0075ED5A), ref: 0075D88D
                                                                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0075F3E3
                                                                                                                    • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0075F3EE
                                                                                                                    • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0075F411
                                                                                                                    • _wcscat.LIBCMT ref: 0075F441
                                                                                                                    • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0075F458
                                                                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0075F471
                                                                                                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 0075F488
                                                                                                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 0075F4AA
                                                                                                                    • DragFinish.SHELL32(?), ref: 0075F4B1
                                                                                                                    • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0075F59C
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                                                                                    • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                                    • API String ID: 169749273-3440237614
                                                                                                                    • Opcode ID: aadaae3d9c5755cf2abac000ae9cbbe979b1086e7a3df836a1cedf40e017f115
                                                                                                                    • Instruction ID: 306cb9e9e2f26a60c50f17d9894ae41a19d58ef29d6a0cdcc175da45b2905b39
                                                                                                                    • Opcode Fuzzy Hash: aadaae3d9c5755cf2abac000ae9cbbe979b1086e7a3df836a1cedf40e017f115
                                                                                                                    • Instruction Fuzzy Hash: 4D616B71008304AFC310EF64CC49EAFBBF8EF89754F404A1EF695921A1DB749A49CB56
                                                                                                                    Function 0073AAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • VariantInit.OLEAUT32(00000000), ref: 0073AB3D
                                                                                                                    • VariantCopy.OLEAUT32(?,?), ref: 0073AB46
                                                                                                                    • VariantClear.OLEAUT32(?), ref: 0073AB52
                                                                                                                    • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 0073AC40
                                                                                                                    • __swprintf.LIBCMT ref: 0073AC70
                                                                                                                    • VarR8FromDec.OLEAUT32(?,?), ref: 0073AC9C
                                                                                                                    • VariantInit.OLEAUT32(?), ref: 0073AD4D
                                                                                                                    • SysFreeString.OLEAUT32(00000016), ref: 0073ADDF
                                                                                                                    • VariantClear.OLEAUT32(?), ref: 0073AE35
                                                                                                                    • VariantClear.OLEAUT32(?), ref: 0073AE44
                                                                                                                    • VariantInit.OLEAUT32(00000000), ref: 0073AE80
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
                                                                                                                    • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                                                                                    • API String ID: 3730832054-3931177956
                                                                                                                    • Opcode ID: 3e783a1482a9aa6a72a81b270f66ab74d296f84bcc2f3448c211f8014250957a
                                                                                                                    • Instruction ID: 2474bf294588225efe11cdda34f519fb523496a89f4871141eb01547640c2ca9
                                                                                                                    • Opcode Fuzzy Hash: 3e783a1482a9aa6a72a81b270f66ab74d296f84bcc2f3448c211f8014250957a
                                                                                                                    • Instruction Fuzzy Hash: D2D1D2B1600219FBEB209F65C88AB6AF7B5FF04700F148555F4859B192DB7CEC40DBA6
                                                                                                                    Function 0075716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CharUpperBuffW.USER32(?,?), ref: 007571FC
                                                                                                                    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00757247
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: BuffCharMessageSendUpper
                                                                                                                    • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                                                                    • API String ID: 3974292440-4258414348
                                                                                                                    • Opcode ID: 6ab90bc028c97f8f0e3f3ea1820047de3c5bc57693c267f6a3e0d456cdcb8dcc
                                                                                                                    • Instruction ID: 9027857f3f5dd2198226601a699178718093e0eeff38cf5c175f29ecdcf1d877
                                                                                                                    • Opcode Fuzzy Hash: 6ab90bc028c97f8f0e3f3ea1820047de3c5bc57693c267f6a3e0d456cdcb8dcc
                                                                                                                    • Instruction Fuzzy Hash: DF917F74204645CBCB08EF10D845AAEB7A2BF95310F00496CFD965B393DB79ED0ACB95
                                                                                                                    Function 0072CB82 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 239COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • EnumChildWindows.USER32(?,0072CF50), ref: 0072CE90
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ChildEnumWindows
                                                                                                                    • String ID: 4+z$CLASS$CLASSNN$H+z$INSTANCE$L+z$NAME$P+z$REGEXPCLASS$T+z$TEXT
                                                                                                                    • API String ID: 3555792229-4288244371
                                                                                                                    • Opcode ID: 5fc40a838e975c3a2a7b8c2a1ad6ebd79c4efecb6aaad4cd72437f17a9dc33b2
                                                                                                                    • Instruction ID: cd63dd5ac60b322afa3195a05dd5624ad31c8b4502156fb80841a94bdaf51088
                                                                                                                    • Opcode Fuzzy Hash: 5fc40a838e975c3a2a7b8c2a1ad6ebd79c4efecb6aaad4cd72437f17a9dc33b2
                                                                                                                    • Instruction Fuzzy Hash: 8191C470A0011AEBDB19DF64D481BEEFB75FF14300F508529E949A7181DF38699ACBE0
                                                                                                                    Function 0075E4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0075E5AB
                                                                                                                    • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,0075BEAF), ref: 0075E607
                                                                                                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0075E647
                                                                                                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0075E68C
                                                                                                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0075E6C3
                                                                                                                    • FreeLibrary.KERNEL32(?,00000004,?,?,?,?,0075BEAF), ref: 0075E6CF
                                                                                                                    • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0075E6DF
                                                                                                                    • DestroyIcon.USER32(?,?,?,?,?,0075BEAF), ref: 0075E6EE
                                                                                                                    • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0075E70B
                                                                                                                    • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0075E717
                                                                                                                      • Part of subcall function 00710FA7: __wcsicmp_l.LIBCMT ref: 00711030
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                                                                                    • String ID: .dll$.exe$.icl
                                                                                                                    • API String ID: 1212759294-1154884017
                                                                                                                    • Opcode ID: 762e87be232f247e05da44af30532ad3e149ecada13da56b07ae3fc91d193f70
                                                                                                                    • Instruction ID: eb08c76fb524e714139b0355748caf7357a28a561fc3d397615c940d6e050c35
                                                                                                                    • Opcode Fuzzy Hash: 762e87be232f247e05da44af30532ad3e149ecada13da56b07ae3fc91d193f70
                                                                                                                    • Instruction Fuzzy Hash: 0E61BFB1500219FAEB289F64CC46FFA77A8FF18765F104105F915D60D1EBB8AA94CBA0
                                                                                                                    Function 0073D219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F936C: __swprintf.LIBCMT ref: 006F93AB
                                                                                                                      • Part of subcall function 006F936C: __itow.LIBCMT ref: 006F93DF
                                                                                                                    • CharLowerBuffW.USER32(?,?), ref: 0073D292
                                                                                                                    • GetDriveTypeW.KERNEL32 ref: 0073D2DF
                                                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0073D327
                                                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0073D35E
                                                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0073D38C
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: SendString$BuffCharDriveLowerType__itow__swprintf
                                                                                                                    • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                                    • API String ID: 1148790751-4113822522
                                                                                                                    • Opcode ID: 7d8c3d91535024874cea25adcb225f4da58dbb198182303ca7c45a718aac721c
                                                                                                                    • Instruction ID: 2b37c5ced92d45ef4f1f8bb5a3a5ac3ae38114a3c8c2d97ae0d5e31dbe4d47df
                                                                                                                    • Opcode Fuzzy Hash: 7d8c3d91535024874cea25adcb225f4da58dbb198182303ca7c45a718aac721c
                                                                                                                    • Instruction Fuzzy Hash: F0515B715043089FD700EF10D98196AB3F5FF89758F00896DF996672A2DB35EE0ACB92
                                                                                                                    Function 007326BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00763973,00000016,0000138C,00000016,?,00000016,0078DDB4,00000000,?), ref: 007326F1
                                                                                                                    • LoadStringW.USER32(00000000,?,00763973,00000016), ref: 007326FA
                                                                                                                    • GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00763973,00000016,0000138C,00000016,?,00000016,0078DDB4,00000000,?,00000016), ref: 0073271C
                                                                                                                    • LoadStringW.USER32(00000000,?,00763973,00000016), ref: 0073271F
                                                                                                                    • __swprintf.LIBCMT ref: 0073276F
                                                                                                                    • __swprintf.LIBCMT ref: 00732780
                                                                                                                    • _wprintf.LIBCMT ref: 00732829
                                                                                                                    • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00732840
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HandleLoadModuleString__swprintf$Message_wprintf
                                                                                                                    • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                                                                    • API String ID: 618562835-2268648507
                                                                                                                    • Opcode ID: 66753a73166d9685cff4af34e152739cc656c0310288b2c192adc30ecb0a82a0
                                                                                                                    • Instruction ID: 52160fa7bdb2ee82db50cd1586274fb1587c8245550f54741668a1a73596caa8
                                                                                                                    • Opcode Fuzzy Hash: 66753a73166d9685cff4af34e152739cc656c0310288b2c192adc30ecb0a82a0
                                                                                                                    • Instruction Fuzzy Hash: B5414E7280021CAADB14FBD4DE87EFEB779AF55340F100069B70676092EA386F59CB65
                                                                                                                    Function 0073D0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0073D0D8
                                                                                                                    • __swprintf.LIBCMT ref: 0073D0FA
                                                                                                                    • CreateDirectoryW.KERNEL32(?,00000000), ref: 0073D137
                                                                                                                    • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0073D15C
                                                                                                                    • _memset.LIBCMT ref: 0073D17B
                                                                                                                    • _wcsncpy.LIBCMT ref: 0073D1B7
                                                                                                                    • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0073D1EC
                                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0073D1F7
                                                                                                                    • RemoveDirectoryW.KERNEL32(?), ref: 0073D200
                                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0073D20A
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                                                                    • String ID: :$\$\??\%s
                                                                                                                    • API String ID: 2733774712-3457252023
                                                                                                                    • Opcode ID: ef5d36e4f36ec64cb401710bef05e222a6719182c8395f0a3cc9caa354ab7963
                                                                                                                    • Instruction ID: bc04c2e3f60596beaeea397d7df7d80f90ff88818d9b406fa48dad525516cc7c
                                                                                                                    • Opcode Fuzzy Hash: ef5d36e4f36ec64cb401710bef05e222a6719182c8395f0a3cc9caa354ab7963
                                                                                                                    • Instruction Fuzzy Hash: 3C3183B2500109ABEB31DFA4DC49FEB77BDEF89740F1081B5F509D21A1E7789A858B24
                                                                                                                    Function 0075E731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,0075BEF4,?,?), ref: 0075E754
                                                                                                                    • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0075BEF4,?,?,00000000,?), ref: 0075E76B
                                                                                                                    • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0075BEF4,?,?,00000000,?), ref: 0075E776
                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,0075BEF4,?,?,00000000,?), ref: 0075E783
                                                                                                                    • GlobalLock.KERNEL32(00000000), ref: 0075E78C
                                                                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,0075BEF4,?,?,00000000,?), ref: 0075E79B
                                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 0075E7A4
                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,0075BEF4,?,?,00000000,?), ref: 0075E7AB
                                                                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0075BEF4,?,?,00000000,?), ref: 0075E7BC
                                                                                                                    • OleLoadPicture.OLEAUT32(?,00000000,00000000,0077D9BC,?), ref: 0075E7D5
                                                                                                                    • GlobalFree.KERNEL32(00000000), ref: 0075E7E5
                                                                                                                    • GetObjectW.GDI32(00000000,00000018,?), ref: 0075E809
                                                                                                                    • CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0075E834
                                                                                                                    • DeleteObject.GDI32(00000000), ref: 0075E85C
                                                                                                                    • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0075E872
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3840717409-0
                                                                                                                    • Opcode ID: f686c45f8fcd750b1e93d97693b3103bd3035703a0af2ff26eff26b25a1f8e21
                                                                                                                    • Instruction ID: e533b89e597aa433dfa117e1ec87d4c92bb398ed47c3415f03d06c8765865e7c
                                                                                                                    • Opcode Fuzzy Hash: f686c45f8fcd750b1e93d97693b3103bd3035703a0af2ff26eff26b25a1f8e21
                                                                                                                    • Instruction Fuzzy Hash: C6415B75600204FFDB219F65CC48EAA7BB9FF89751F108458F909D7260D779AE85CB20
                                                                                                                    Function 007405F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __wsplitpath.LIBCMT ref: 0074076F
                                                                                                                    • _wcscat.LIBCMT ref: 00740787
                                                                                                                    • _wcscat.LIBCMT ref: 00740799
                                                                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007407AE
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 007407C2
                                                                                                                    • GetFileAttributesW.KERNEL32(?), ref: 007407DA
                                                                                                                    • SetFileAttributesW.KERNEL32(?,00000000), ref: 007407F4
                                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00740806
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                                                                                    • String ID: *.*
                                                                                                                    • API String ID: 34673085-438819550
                                                                                                                    • Opcode ID: 5b8067968ed2f0b00e154ab3a73aee2943e2fc9ff16b49e54d3d8febf0852130
                                                                                                                    • Instruction ID: 5330c3093866e0613ea94f1a1b20fc26754f1dafa72f223f14fb006f2e3a00af
                                                                                                                    • Opcode Fuzzy Hash: 5b8067968ed2f0b00e154ab3a73aee2943e2fc9ff16b49e54d3d8febf0852130
                                                                                                                    • Instruction Fuzzy Hash: 41818171504305DFCB24DF24C84596AB3E9BF88344F15882EFA8AD7251E738E9958BD2
                                                                                                                    Function 0075EEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070B34E: GetWindowLongW.USER32(?,000000EB), ref: 0070B35F
                                                                                                                    • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0075EF3B
                                                                                                                    • GetFocus.USER32 ref: 0075EF4B
                                                                                                                    • GetDlgCtrlID.USER32(00000000), ref: 0075EF56
                                                                                                                    • _memset.LIBCMT ref: 0075F081
                                                                                                                    • GetMenuItemInfoW.USER32 ref: 0075F0AC
                                                                                                                    • GetMenuItemCount.USER32(00000000), ref: 0075F0CC
                                                                                                                    • GetMenuItemID.USER32(?,00000000), ref: 0075F0DF
                                                                                                                    • GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 0075F113
                                                                                                                    • GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 0075F15B
                                                                                                                    • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0075F193
                                                                                                                    • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0075F1C8
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                                                                                    • String ID: 0
                                                                                                                    • API String ID: 1296962147-4108050209
                                                                                                                    • Opcode ID: e409ec35c2ce4a7b1b1324cb61f21267e9c3b760d30cf8cb8865dfc87146d396
                                                                                                                    • Instruction ID: b624f35b8da6a27209f01e3fb5ecdfb0c45f1b6813ba2f6a01b70a9533d8ae40
                                                                                                                    • Opcode Fuzzy Hash: e409ec35c2ce4a7b1b1324cb61f21267e9c3b760d30cf8cb8865dfc87146d396
                                                                                                                    • Instruction Fuzzy Hash: 8F818A70204305EFD724CF14C884AABBBE9FF88355F10452EF99997291DBB8D949CB92
                                                                                                                    Function 0072A867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0072ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0072ABD7
                                                                                                                      • Part of subcall function 0072ABBB: GetLastError.KERNEL32(?,0072A69F,?,?,?), ref: 0072ABE1
                                                                                                                      • Part of subcall function 0072ABBB: GetProcessHeap.KERNEL32(00000008,?,?,0072A69F,?,?,?), ref: 0072ABF0
                                                                                                                      • Part of subcall function 0072ABBB: HeapAlloc.KERNEL32(00000000,?,0072A69F,?,?,?), ref: 0072ABF7
                                                                                                                      • Part of subcall function 0072ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0072AC0E
                                                                                                                      • Part of subcall function 0072AC56: GetProcessHeap.KERNEL32(00000008,0072A6B5,00000000,00000000,?,0072A6B5,?), ref: 0072AC62
                                                                                                                      • Part of subcall function 0072AC56: HeapAlloc.KERNEL32(00000000,?,0072A6B5,?), ref: 0072AC69
                                                                                                                      • Part of subcall function 0072AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,0072A6B5,?), ref: 0072AC7A
                                                                                                                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0072A8CB
                                                                                                                    • _memset.LIBCMT ref: 0072A8E0
                                                                                                                    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0072A8FF
                                                                                                                    • GetLengthSid.ADVAPI32(?), ref: 0072A910
                                                                                                                    • GetAce.ADVAPI32(?,00000000,?), ref: 0072A94D
                                                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 0072A969
                                                                                                                    • GetLengthSid.ADVAPI32(?), ref: 0072A986
                                                                                                                    • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 0072A995
                                                                                                                    • HeapAlloc.KERNEL32(00000000), ref: 0072A99C
                                                                                                                    • GetLengthSid.ADVAPI32(?,00000008,?), ref: 0072A9BD
                                                                                                                    • CopySid.ADVAPI32(00000000), ref: 0072A9C4
                                                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0072A9F5
                                                                                                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0072AA1B
                                                                                                                    • SetUserObjectSecurity.USER32(?,00000004,?), ref: 0072AA2F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3996160137-0
                                                                                                                    • Opcode ID: bd4d29f95f9c06e4532ac503fb880e80d1bd9849ddd9cd3ce3e18e369d027e6e
                                                                                                                    • Instruction ID: ff686cb40f2becc0488600f6d5cd8853aee6c03eb6ad2b9e97bc4988f086aee8
                                                                                                                    • Opcode Fuzzy Hash: bd4d29f95f9c06e4532ac503fb880e80d1bd9849ddd9cd3ce3e18e369d027e6e
                                                                                                                    • Instruction Fuzzy Hash: 06514AB1900219BFDF10DF95ED85EEEBBB9FF04310F048129F915A6290DB399A45CB61
                                                                                                                    Function 0073CC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: LoadString__swprintf_wprintf
                                                                                                                    • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                                    • API String ID: 2889450990-2391861430
                                                                                                                    • Opcode ID: 56c40f0ff56c27f8f23d5d20d25cba2bce15eaa2b31e9ab07f85b0551ac7483a
                                                                                                                    • Instruction ID: 29e9ad1f598df7d21e8f4aa3a848ca78cee01af8754ab2d43d64c125c189f60c
                                                                                                                    • Opcode Fuzzy Hash: 56c40f0ff56c27f8f23d5d20d25cba2bce15eaa2b31e9ab07f85b0551ac7483a
                                                                                                                    • Instruction Fuzzy Hash: B951CC7290010DBADB11FBA0CE46EEEB779AF08300F504169F605720A2EB396F59CB65
                                                                                                                    Function 0073CA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: LoadString__swprintf_wprintf
                                                                                                                    • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                                    • API String ID: 2889450990-3420473620
                                                                                                                    • Opcode ID: 1c0ab601dafb69b728346646fbf16efbc01ca3ab62cf7808a659053d854019eb
                                                                                                                    • Instruction ID: 6338f1e659ef354820ce8df2acbdf24a712583f7159c5ce7ff70123927c45f11
                                                                                                                    • Opcode Fuzzy Hash: 1c0ab601dafb69b728346646fbf16efbc01ca3ab62cf7808a659053d854019eb
                                                                                                                    • Instruction Fuzzy Hash: 3D51CF7180010DAADB15FBE0CE46EEEB779AF04300F504169F206720A2EB386F99CF65
                                                                                                                    Function 00753C06 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00752BB5,?,?), ref: 00753C1D
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: BuffCharUpper
                                                                                                                    • String ID: $Ez$HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                                                                    • API String ID: 3964851224-1562404639
                                                                                                                    • Opcode ID: ce80efc0913f0f5e13e01b15974c5547759f2b81532cf7e0c252a09530cd149f
                                                                                                                    • Instruction ID: 7120a322b93ec105dfad041ca96b7cdfe66f54a99cb81c28fbc0e1cf8f94e1b5
                                                                                                                    • Opcode Fuzzy Hash: ce80efc0913f0f5e13e01b15974c5547759f2b81532cf7e0c252a09530cd149f
                                                                                                                    • Instruction Fuzzy Hash: E8413F30600349CBDF04EF14D855AEB3375AF92381F104969FC555B1A2EBBA9A1ACB20
                                                                                                                    Function 007355BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 007355D7
                                                                                                                    • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00735664
                                                                                                                    • GetMenuItemCount.USER32(007B1708), ref: 007356ED
                                                                                                                    • DeleteMenu.USER32(007B1708,00000005,00000000,000000F5,?,?), ref: 0073577D
                                                                                                                    • DeleteMenu.USER32(007B1708,00000004,00000000), ref: 00735785
                                                                                                                    • DeleteMenu.USER32(007B1708,00000006,00000000), ref: 0073578D
                                                                                                                    • DeleteMenu.USER32(007B1708,00000003,00000000), ref: 00735795
                                                                                                                    • GetMenuItemCount.USER32(007B1708), ref: 0073579D
                                                                                                                    • SetMenuItemInfoW.USER32(007B1708,00000004,00000000,00000030), ref: 007357D3
                                                                                                                    • GetCursorPos.USER32(?), ref: 007357DD
                                                                                                                    • SetForegroundWindow.USER32(00000000), ref: 007357E6
                                                                                                                    • TrackPopupMenuEx.USER32(007B1708,00000000,?,00000000,00000000,00000000), ref: 007357F9
                                                                                                                    • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00735805
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3993528054-0
                                                                                                                    • Opcode ID: 390c487c17eb8f05cee3b89b1014339eddc3012a44e13dcf1ab90d7233a381cd
                                                                                                                    • Instruction ID: 24deb95fb223c77357cb3545273e48d8d89f5e5e2987f9efd85e4d7dcbeb830a
                                                                                                                    • Opcode Fuzzy Hash: 390c487c17eb8f05cee3b89b1014339eddc3012a44e13dcf1ab90d7233a381cd
                                                                                                                    • Instruction Fuzzy Hash: D271F470640605FFFB209B15CC4AFAABF65FF00764F644205F519AA1E2C7796C50DB94
                                                                                                                    Function 0072A14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 0072A1DC
                                                                                                                    • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 0072A211
                                                                                                                    • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 0072A22D
                                                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 0072A249
                                                                                                                    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 0072A273
                                                                                                                    • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 0072A29B
                                                                                                                    • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0072A2A6
                                                                                                                    • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0072A2AB
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
                                                                                                                    • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                                    • API String ID: 1687751970-22481851
                                                                                                                    • Opcode ID: 50370915da32d436cd52ea7ee8612d93780ac2edbca916db73d546d496ec99cb
                                                                                                                    • Instruction ID: f7694f576ac7c69316587c2ddf643cca68918871b15a634cf1393a9ccb0f60ca
                                                                                                                    • Opcode Fuzzy Hash: 50370915da32d436cd52ea7ee8612d93780ac2edbca916db73d546d496ec99cb
                                                                                                                    • Instruction Fuzzy Hash: 5141F576C1022DABDB21EBA4EC85DEDB7B9BF04350F004129F905B3161EA78AE45CB95
                                                                                                                    Function 007367E9 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __swprintf.LIBCMT ref: 007367FD
                                                                                                                    • __swprintf.LIBCMT ref: 0073680A
                                                                                                                      • Part of subcall function 0071172B: __woutput_l.LIBCMT ref: 00711784
                                                                                                                    • FindResourceW.KERNEL32(?,?,0000000E), ref: 00736834
                                                                                                                    • LoadResource.KERNEL32(?,00000000), ref: 00736840
                                                                                                                    • LockResource.KERNEL32(00000000), ref: 0073684D
                                                                                                                    • FindResourceW.KERNEL32(?,?,00000003), ref: 0073686D
                                                                                                                    • LoadResource.KERNEL32(?,00000000), ref: 0073687F
                                                                                                                    • SizeofResource.KERNEL32(?,00000000), ref: 0073688E
                                                                                                                    • LockResource.KERNEL32(?), ref: 0073689A
                                                                                                                    • CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 007368F9
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
                                                                                                                    • String ID: 5z
                                                                                                                    • API String ID: 1433390588-4140879368
                                                                                                                    • Opcode ID: fb44bfc183681fee1dc1cd8fd08f276230cd647d0891e716514c4a1cf9b70e2b
                                                                                                                    • Instruction ID: 28e8761d52a822d498c2d71691b3f6f2ddd684a27a5b03a22361f8a05e3a25fe
                                                                                                                    • Opcode Fuzzy Hash: fb44bfc183681fee1dc1cd8fd08f276230cd647d0891e716514c4a1cf9b70e2b
                                                                                                                    • Instruction Fuzzy Hash: 95316F7190021ABBEB119F60DD59EFA7BB8FF08380F10C525F906D2152E778D9619BA4
                                                                                                                    Function 007325B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,007636F4,00000010,?,Bad directive syntax error,0078DC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 007325D6
                                                                                                                    • LoadStringW.USER32(00000000,?,007636F4,00000010), ref: 007325DD
                                                                                                                    • _wprintf.LIBCMT ref: 00732610
                                                                                                                    • __swprintf.LIBCMT ref: 00732632
                                                                                                                    • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 007326A1
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HandleLoadMessageModuleString__swprintf_wprintf
                                                                                                                    • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                                                                    • API String ID: 1080873982-4153970271
                                                                                                                    • Opcode ID: 8d327b0524a2d2fccf22acad451a889c887c36e3d0eda29848d621642626f1f8
                                                                                                                    • Instruction ID: 2e694497b3884a6432a9820fa4a1862c131bf0c7230694cc99bedd19c72f18ef
                                                                                                                    • Opcode Fuzzy Hash: 8d327b0524a2d2fccf22acad451a889c887c36e3d0eda29848d621642626f1f8
                                                                                                                    • Instruction Fuzzy Hash: A9216B7190021EEFCF11EF90CC0AEEE7B39BF18304F004459F605660A3EA79AA69DB55
                                                                                                                    Function 00737AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00737B42
                                                                                                                    • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00737B58
                                                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00737B69
                                                                                                                    • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00737B7B
                                                                                                                    • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00737B8C
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: SendString
                                                                                                                    • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                                                                    • API String ID: 890592661-1007645807
                                                                                                                    • Opcode ID: 3f7ac90fb4da57f85755cdb1eb462eaeeec7e7917ee3566a8c9d8e3f05e5435e
                                                                                                                    • Instruction ID: c26b229617804b0904de4113a449727792db5479c6bd929c93063e21404296b8
                                                                                                                    • Opcode Fuzzy Hash: 3f7ac90fb4da57f85755cdb1eb462eaeeec7e7917ee3566a8c9d8e3f05e5435e
                                                                                                                    • Instruction Fuzzy Hash: D211C4E164026D79E764BB65CC8ADFFBABCEBD2B10F00051D7512A20C1DA641E44C9B1
                                                                                                                    Function 0073778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • timeGetTime.WINMM ref: 00737794
                                                                                                                      • Part of subcall function 0070DC38: timeGetTime.WINMM(?,75A4B400,007658AB), ref: 0070DC3C
                                                                                                                    • Sleep.KERNEL32(0000000A), ref: 007377C0
                                                                                                                    • EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 007377E4
                                                                                                                    • FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00737806
                                                                                                                    • SetActiveWindow.USER32 ref: 00737825
                                                                                                                    • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00737833
                                                                                                                    • SendMessageW.USER32(00000010,00000000,00000000), ref: 00737852
                                                                                                                    • Sleep.KERNEL32(000000FA), ref: 0073785D
                                                                                                                    • IsWindow.USER32 ref: 00737869
                                                                                                                    • EndDialog.USER32(00000000), ref: 0073787A
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                                                                    • String ID: BUTTON
                                                                                                                    • API String ID: 1194449130-3405671355
                                                                                                                    • Opcode ID: 2aae90b439e8016ee784cbfb65b23af9276aa77ce1954bb126a5b0a7fbcc164e
                                                                                                                    • Instruction ID: 8b3f5a45bf15234522efb4dc60ec27438cee554a418b94537c8f4b7e5ca20032
                                                                                                                    • Opcode Fuzzy Hash: 2aae90b439e8016ee784cbfb65b23af9276aa77ce1954bb126a5b0a7fbcc164e
                                                                                                                    • Instruction Fuzzy Hash: 86213EB0204209AFF7295B60EC9DF663FB9FB44399F008224F50996163DB7D5D90DA28
                                                                                                                    Function 007402EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F936C: __swprintf.LIBCMT ref: 006F93AB
                                                                                                                      • Part of subcall function 006F936C: __itow.LIBCMT ref: 006F93DF
                                                                                                                    • CoInitialize.OLE32(00000000), ref: 0074034B
                                                                                                                    • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 007403DE
                                                                                                                    • SHGetDesktopFolder.SHELL32(?), ref: 007403F2
                                                                                                                    • CoCreateInstance.OLE32(0077DA8C,00000000,00000001,007A3CF8,?), ref: 0074043E
                                                                                                                    • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 007404AD
                                                                                                                    • CoTaskMemFree.OLE32(?,?), ref: 00740505
                                                                                                                    • _memset.LIBCMT ref: 00740542
                                                                                                                    • SHBrowseForFolderW.SHELL32(?), ref: 0074057E
                                                                                                                    • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 007405A1
                                                                                                                    • CoTaskMemFree.OLE32(00000000), ref: 007405A8
                                                                                                                    • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 007405DF
                                                                                                                    • CoUninitialize.OLE32(00000001,00000000), ref: 007405E1
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1246142700-0
                                                                                                                    • Opcode ID: 17bb392ba2e2a2a7bb7918e6d29b92c2987969bbd83ca3c33fab01bfb1af5ef1
                                                                                                                    • Instruction ID: db70d94e8a55692cb49e4b46a1bfb52c4bdbad39ed0e4a143fded20e43bedcec
                                                                                                                    • Opcode Fuzzy Hash: 17bb392ba2e2a2a7bb7918e6d29b92c2987969bbd83ca3c33fab01bfb1af5ef1
                                                                                                                    • Instruction Fuzzy Hash: 2AB1DA75A00209AFDB14DFA4C889DAEBBB9FF48314B148469F909EB251DB34ED41CB94
                                                                                                                    Function 00732E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetKeyboardState.USER32(?), ref: 00732ED6
                                                                                                                    • SetKeyboardState.USER32(?), ref: 00732F41
                                                                                                                    • GetAsyncKeyState.USER32(000000A0), ref: 00732F61
                                                                                                                    • GetKeyState.USER32(000000A0), ref: 00732F78
                                                                                                                    • GetAsyncKeyState.USER32(000000A1), ref: 00732FA7
                                                                                                                    • GetKeyState.USER32(000000A1), ref: 00732FB8
                                                                                                                    • GetAsyncKeyState.USER32(00000011), ref: 00732FE4
                                                                                                                    • GetKeyState.USER32(00000011), ref: 00732FF2
                                                                                                                    • GetAsyncKeyState.USER32(00000012), ref: 0073301B
                                                                                                                    • GetKeyState.USER32(00000012), ref: 00733029
                                                                                                                    • GetAsyncKeyState.USER32(0000005B), ref: 00733052
                                                                                                                    • GetKeyState.USER32(0000005B), ref: 00733060
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: State$Async$Keyboard
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 541375521-0
                                                                                                                    • Opcode ID: 39a2a0fec7390d2b677a5c1dd1a4e04bcbc3574e2e95838816fe24c4ff2b37d7
                                                                                                                    • Instruction ID: b667f9fa8e9b18b0fc9169aaf0329198642d0274f6b781934658b9f624a43987
                                                                                                                    • Opcode Fuzzy Hash: 39a2a0fec7390d2b677a5c1dd1a4e04bcbc3574e2e95838816fe24c4ff2b37d7
                                                                                                                    • Instruction Fuzzy Hash: 9E51F830A0879869FB35DBB488157EABFF49F11340F08858DD5C25A1C3DA5CAB8DC7A2
                                                                                                                    Function 0072ED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetDlgItem.USER32(?,00000001), ref: 0072ED1E
                                                                                                                    • GetWindowRect.USER32(00000000,?), ref: 0072ED30
                                                                                                                    • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0072ED8E
                                                                                                                    • GetDlgItem.USER32(?,00000002), ref: 0072ED99
                                                                                                                    • GetWindowRect.USER32(00000000,?), ref: 0072EDAB
                                                                                                                    • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0072EE01
                                                                                                                    • GetDlgItem.USER32(?,000003E9), ref: 0072EE0F
                                                                                                                    • GetWindowRect.USER32(00000000,?), ref: 0072EE20
                                                                                                                    • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0072EE63
                                                                                                                    • GetDlgItem.USER32(?,000003EA), ref: 0072EE71
                                                                                                                    • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0072EE8E
                                                                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 0072EE9B
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$ItemMoveRect$Invalidate
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3096461208-0
                                                                                                                    • Opcode ID: 89847d33f3858762608d7527affde7aa09abbe247422e2b563c2cc4acff508f4
                                                                                                                    • Instruction ID: cbea1c19f6548685bb23a29b8c77723ec5b3861dd1501c972a4d09da5fc3fd96
                                                                                                                    • Opcode Fuzzy Hash: 89847d33f3858762608d7527affde7aa09abbe247422e2b563c2cc4acff508f4
                                                                                                                    • Instruction Fuzzy Hash: 53513EB1B00205AFDB18DF68DD89AAEBBBAFF88750F14812DF519E7290D7749D408B14
                                                                                                                    Function 0070B73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,0070B759,?,00000000,?,?,?,?,0070B72B,00000000,?), ref: 0070BA58
                                                                                                                    • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0070B72B), ref: 0070B7F6
                                                                                                                    • KillTimer.USER32(00000000,?,00000000,?,?,?,?,0070B72B,00000000,?,?,0070B2EF,?,?), ref: 0070B88D
                                                                                                                    • DestroyAcceleratorTable.USER32(00000000), ref: 0076D8A6
                                                                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0070B72B,00000000,?,?,0070B2EF,?,?), ref: 0076D8D7
                                                                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0070B72B,00000000,?,?,0070B2EF,?,?), ref: 0076D8EE
                                                                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0070B72B,00000000,?,?,0070B2EF,?,?), ref: 0076D90A
                                                                                                                    • DeleteObject.GDI32(00000000), ref: 0076D91C
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 641708696-0
                                                                                                                    • Opcode ID: 6defd18b9d089c6df6d7927a71837e10055bcc63fcf2871458a746db2955261f
                                                                                                                    • Instruction ID: 20246cb5a9391439ee3d63439ebd76083d4a03c052cee473678f46c72db7995f
                                                                                                                    • Opcode Fuzzy Hash: 6defd18b9d089c6df6d7927a71837e10055bcc63fcf2871458a746db2955261f
                                                                                                                    • Instruction Fuzzy Hash: E5616730A10701CFDB359F14D898B25B7F5FF94359F64962AE44686AB0CB7CAD80CB88
                                                                                                                    Function 0070B40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070B526: GetWindowLongW.USER32(?,000000EB), ref: 0070B537
                                                                                                                    • GetSysColor.USER32(0000000F), ref: 0070B438
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ColorLongWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 259745315-0
                                                                                                                    • Opcode ID: b4b927493e01499da89a94527dee7020a8b7d28728c40bb04809b296b13fa0a8
                                                                                                                    • Instruction ID: 5a9efcb5249e6317f757124561c7b3084350334873ef77c85198ec412b86ac8c
                                                                                                                    • Opcode Fuzzy Hash: b4b927493e01499da89a94527dee7020a8b7d28728c40bb04809b296b13fa0a8
                                                                                                                    • Instruction Fuzzy Hash: 3741A030100184EBDB305F28DC89BB93BA6AF46770F588361FD698E1E6D7398E81D725
                                                                                                                    Function 0073690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 136442275-0
                                                                                                                    • Opcode ID: d552267723b0391cbf11a476abf654c39084360d1bcc2c134ad62458d5d8ed10
                                                                                                                    • Instruction ID: b7e0954b0ae3f3961df0e5dd23df1d985bd69aaa84af01a289639f07ca47fa1b
                                                                                                                    • Opcode Fuzzy Hash: d552267723b0391cbf11a476abf654c39084360d1bcc2c134ad62458d5d8ed10
                                                                                                                    • Instruction Fuzzy Hash: 1141317684511CAEDF61EB94DC45DCFB3BCEB44300F1081A6F699A2091EE74ABE58F90
                                                                                                                    Function 0073D76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CharLowerBuffW.USER32(0078DC00,0078DC00,0078DC00), ref: 0073D7CE
                                                                                                                    • GetDriveTypeW.KERNEL32(?,007A3A70,00000061), ref: 0073D898
                                                                                                                    • _wcscpy.LIBCMT ref: 0073D8C2
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: BuffCharDriveLowerType_wcscpy
                                                                                                                    • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                                                                    • API String ID: 2820617543-1000479233
                                                                                                                    • Opcode ID: 172735e14048c47b4401bb465688ec37df8772466e169b02f90cd2a75505e374
                                                                                                                    • Instruction ID: 9d2ce885d236966fd140844a9fbbe8f1f6cb0392443e6e4d7ef6097e703b9d32
                                                                                                                    • Opcode Fuzzy Hash: 172735e14048c47b4401bb465688ec37df8772466e169b02f90cd2a75505e374
                                                                                                                    • Instruction Fuzzy Hash: A2519071104304EFD720EF14D886AABB7E5EF85314F10892DF59A572A3DB39ED05CA52
                                                                                                                    Function 006F936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __swprintf.LIBCMT ref: 006F93AB
                                                                                                                    • __itow.LIBCMT ref: 006F93DF
                                                                                                                      • Part of subcall function 00711557: _xtow@16.LIBCMT ref: 00711578
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __itow__swprintf_xtow@16
                                                                                                                    • String ID: %.15g$0x%p$False$True
                                                                                                                    • API String ID: 1502193981-2263619337
                                                                                                                    • Opcode ID: e1690d4beacda0139123c7acc6c37c120e3972ef44936dd752c7ce799af1bddd
                                                                                                                    • Instruction ID: 39dc244cf25ca2242442a93a29a219aaeef44ad9c3e8287edf277fc893106bb9
                                                                                                                    • Opcode Fuzzy Hash: e1690d4beacda0139123c7acc6c37c120e3972ef44936dd752c7ce799af1bddd
                                                                                                                    • Instruction Fuzzy Hash: F541B472504609EBDB24DF78D946FBA77F9EB44300F20446EF64AD72C1EA399942CB60
                                                                                                                    Function 0075A1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0075A259
                                                                                                                    • CreateCompatibleDC.GDI32(00000000), ref: 0075A260
                                                                                                                    • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 0075A273
                                                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 0075A27B
                                                                                                                    • GetPixel.GDI32(00000000,00000000,00000000), ref: 0075A286
                                                                                                                    • DeleteDC.GDI32(00000000), ref: 0075A28F
                                                                                                                    • GetWindowLongW.USER32(?,000000EC), ref: 0075A299
                                                                                                                    • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 0075A2AD
                                                                                                                    • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0075A2B9
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                                                                    • String ID: static
                                                                                                                    • API String ID: 2559357485-2160076837
                                                                                                                    • Opcode ID: b73396629a4c58bc7eb4ecf1f648407966d498667603e98004f58853efcb92bc
                                                                                                                    • Instruction ID: 42c1d132658667beb360a9aa2da5d1f1faceedc73d95ed83d3b85f41839eaa58
                                                                                                                    • Opcode Fuzzy Hash: b73396629a4c58bc7eb4ecf1f648407966d498667603e98004f58853efcb92bc
                                                                                                                    • Instruction Fuzzy Hash: F5316B31100218BBDB215FA4DC49FEA3B79FF4D3A1F114324FA19A60A0C77A9C55DBA5
                                                                                                                    Function 00736F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                                                                    • String ID: 0.0.0.0
                                                                                                                    • API String ID: 2620052-3771769585
                                                                                                                    • Opcode ID: 723a9e7f1e9360888d0b441d2c1abda46e3e3cbcab98fffbb53e21b155732d0d
                                                                                                                    • Instruction ID: e1b2a418ea6c30ea41db0431910eab35371f4cffd9bd0eadc42d894957d18bbd
                                                                                                                    • Opcode Fuzzy Hash: 723a9e7f1e9360888d0b441d2c1abda46e3e3cbcab98fffbb53e21b155732d0d
                                                                                                                    • Instruction Fuzzy Hash: 0F11A571504115BBDB246B74AC4AEEA77BCDF40710F008165F149A6092EE7CDEC58694
                                                                                                                    Function 0071500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 00715047
                                                                                                                      • Part of subcall function 00717C0E: __getptd_noexit.LIBCMT ref: 00717C0E
                                                                                                                    • __gmtime64_s.LIBCMT ref: 007150E0
                                                                                                                    • __gmtime64_s.LIBCMT ref: 00715116
                                                                                                                    • __gmtime64_s.LIBCMT ref: 00715133
                                                                                                                    • __allrem.LIBCMT ref: 00715189
                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007151A5
                                                                                                                    • __allrem.LIBCMT ref: 007151BC
                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007151DA
                                                                                                                    • __allrem.LIBCMT ref: 007151F1
                                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0071520F
                                                                                                                    • __invoke_watson.LIBCMT ref: 00715280
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 384356119-0
                                                                                                                    • Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                                                                                    • Instruction ID: 97d50c0023e6b6045ea13239d3a1223b76596672a91ff77961ca62dfc3285e39
                                                                                                                    • Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                                                                                    • Instruction Fuzzy Hash: 3D71D5B2A00B16EBD7189E7CCC45BEA73A8BF94364F144229F510D62C1E778E9C08BD0
                                                                                                                    Function 00734DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 00734DF8
                                                                                                                    • GetMenuItemInfoW.USER32(007B1708,000000FF,00000000,00000030), ref: 00734E59
                                                                                                                    • SetMenuItemInfoW.USER32(007B1708,00000004,00000000,00000030), ref: 00734E8F
                                                                                                                    • Sleep.KERNEL32(000001F4), ref: 00734EA1
                                                                                                                    • GetMenuItemCount.USER32(?), ref: 00734EE5
                                                                                                                    • GetMenuItemID.USER32(?,00000000), ref: 00734F01
                                                                                                                    • GetMenuItemID.USER32(?,-00000001), ref: 00734F2B
                                                                                                                    • GetMenuItemID.USER32(?,?), ref: 00734F70
                                                                                                                    • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00734FB6
                                                                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00734FCA
                                                                                                                    • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00734FEB
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4176008265-0
                                                                                                                    • Opcode ID: 2348e049d514c5cb55bead5c5d078a81197ea6e31a689469b702f34da5b22a53
                                                                                                                    • Instruction ID: 6a5f9927803598dd2b57f49cbef2d69d1e051d3878896cdfa58c95fd0c85b827
                                                                                                                    • Opcode Fuzzy Hash: 2348e049d514c5cb55bead5c5d078a81197ea6e31a689469b702f34da5b22a53
                                                                                                                    • Instruction Fuzzy Hash: 4461AE7190024AAFEB28CFA4DC88EAE7BB8FF01348F184159F441A3252D738BD45CB21
                                                                                                                    Function 00759C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00759C98
                                                                                                                    • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00759C9B
                                                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 00759CBF
                                                                                                                    • _memset.LIBCMT ref: 00759CD0
                                                                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00759CE2
                                                                                                                    • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00759D5A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$LongWindow_memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 830647256-0
                                                                                                                    • Opcode ID: 6f9febd112e98c804b4af57c2ebd13268d18afcd0dc4d254f46ef85e3dabd5f8
                                                                                                                    • Instruction ID: e9bfa975ea4acd1bdfad172f11af0eeadca389b5e809b6bd1298d58d3d81ea4c
                                                                                                                    • Opcode Fuzzy Hash: 6f9febd112e98c804b4af57c2ebd13268d18afcd0dc4d254f46ef85e3dabd5f8
                                                                                                                    • Instruction Fuzzy Hash: B5616B75A00208EFDB20DFA8CC81EEE77B8EB09714F544199FE14A7291D7B8AD46DB50
                                                                                                                    Function 007294E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 007294FE
                                                                                                                    • SafeArrayAllocData.OLEAUT32(?), ref: 00729549
                                                                                                                    • VariantInit.OLEAUT32(?), ref: 0072955B
                                                                                                                    • SafeArrayAccessData.OLEAUT32(?,?), ref: 0072957B
                                                                                                                    • VariantCopy.OLEAUT32(?,?), ref: 007295BE
                                                                                                                    • SafeArrayUnaccessData.OLEAUT32(?), ref: 007295D2
                                                                                                                    • VariantClear.OLEAUT32(?), ref: 007295E7
                                                                                                                    • SafeArrayDestroyData.OLEAUT32(?), ref: 007295F4
                                                                                                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007295FD
                                                                                                                    • VariantClear.OLEAUT32(?), ref: 0072960F
                                                                                                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0072961A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2706829360-0
                                                                                                                    • Opcode ID: 25f0dc706f3eb16f7e1bd336df1ac2228feee9a044591d2a738a79b7d4d9cc14
                                                                                                                    • Instruction ID: 58100699a5d69946bc197566913424b6f9f6dd7ea52c1b418001601db145b658
                                                                                                                    • Opcode Fuzzy Hash: 25f0dc706f3eb16f7e1bd336df1ac2228feee9a044591d2a738a79b7d4d9cc14
                                                                                                                    • Instruction Fuzzy Hash: E6416F31E00219EFCB11EFA4DC489DEBBB9FF08354F148465E905A3251DB39EA85CBA5
                                                                                                                    Function 0074BB08 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 264COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Variant$ClearInit$_memset
                                                                                                                    • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$h?z$|?z
                                                                                                                    • API String ID: 2862541840-1123076188
                                                                                                                    • Opcode ID: 55d5f9b05c75b4dda1ed48e96a90492fa9645ec7518e6bfef0c741f19fd89ae7
                                                                                                                    • Instruction ID: b4cd755d799c6230b65dbdad434829fe21763c5592ee8394b39e3232eeb50938
                                                                                                                    • Opcode Fuzzy Hash: 55d5f9b05c75b4dda1ed48e96a90492fa9645ec7518e6bfef0c741f19fd89ae7
                                                                                                                    • Instruction Fuzzy Hash: 0C915B71E00219ABDB24CFA5C888FAEBBB8EF85710F108559F515AB281D778DD45CFA0
                                                                                                                    Function 0074ADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F936C: __swprintf.LIBCMT ref: 006F93AB
                                                                                                                      • Part of subcall function 006F936C: __itow.LIBCMT ref: 006F93DF
                                                                                                                    • CoInitialize.OLE32 ref: 0074ADF6
                                                                                                                    • CoUninitialize.OLE32 ref: 0074AE01
                                                                                                                    • CoCreateInstance.OLE32(?,00000000,00000017,0077D8FC,?), ref: 0074AE61
                                                                                                                    • IIDFromString.OLE32(?,?), ref: 0074AED4
                                                                                                                    • VariantInit.OLEAUT32(?), ref: 0074AF6E
                                                                                                                    • VariantClear.OLEAUT32(?), ref: 0074AFCF
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                                                                                    • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                                                                    • API String ID: 834269672-1287834457
                                                                                                                    • Opcode ID: 1f8a9ea66914c76d9e63b06bcc2690491efd4c6a0f8f158f7b96969c5a512a44
                                                                                                                    • Instruction ID: 930fd286565ae82a954d8f6bee8f9637d5da7df9b31664348d40db0c15df220f
                                                                                                                    • Opcode Fuzzy Hash: 1f8a9ea66914c76d9e63b06bcc2690491efd4c6a0f8f158f7b96969c5a512a44
                                                                                                                    • Instruction Fuzzy Hash: 8F61BBB1248311EFD720DF54C849B6ABBE8AF89714F00490DF9859B291C778ED48CB93
                                                                                                                    Function 00748107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • WSAStartup.WSOCK32(00000101,?), ref: 00748168
                                                                                                                    • inet_addr.WSOCK32(?,?,?), ref: 007481AD
                                                                                                                    • gethostbyname.WSOCK32(?), ref: 007481B9
                                                                                                                    • IcmpCreateFile.IPHLPAPI ref: 007481C7
                                                                                                                    • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00748237
                                                                                                                    • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 0074824D
                                                                                                                    • IcmpCloseHandle.IPHLPAPI(00000000), ref: 007482C2
                                                                                                                    • WSACleanup.WSOCK32 ref: 007482C8
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                                                                    • String ID: Ping
                                                                                                                    • API String ID: 1028309954-2246546115
                                                                                                                    • Opcode ID: 3a90388119c4291265ff8fd17bf49254479e9a71bccea3fb6164d194bf3b9079
                                                                                                                    • Instruction ID: 433bcb7e6f72a1221749eab92fb96d3846e797222dde4da5ef71a644ab1199f1
                                                                                                                    • Opcode Fuzzy Hash: 3a90388119c4291265ff8fd17bf49254479e9a71bccea3fb6164d194bf3b9079
                                                                                                                    • Instruction Fuzzy Hash: B95193316047049FD760AF64CC49B2EB7E5BF49350F048919FA59DB2A1DB78ED01CB46
                                                                                                                    Function 0073E389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0073E396
                                                                                                                    • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0073E40C
                                                                                                                    • GetLastError.KERNEL32 ref: 0073E416
                                                                                                                    • SetErrorMode.KERNEL32(00000000,READY), ref: 0073E483
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                                    • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                                    • API String ID: 4194297153-14809454
                                                                                                                    • Opcode ID: 1e32614a16c4da21521f18f88f7d8634ac19230dd08df26abefd76df18840f79
                                                                                                                    • Instruction ID: bc6e9ff24cda6018e15ec573c919783d48cce466013138da20f1aa526d76058a
                                                                                                                    • Opcode Fuzzy Hash: 1e32614a16c4da21521f18f88f7d8634ac19230dd08df26abefd76df18840f79
                                                                                                                    • Instruction Fuzzy Hash: 4831A175A00249AFEB01EF68C945ABDB7B5EF49310F148029F505AB2D2D778AA41CB51
                                                                                                                    Function 0072B907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 0072B98C
                                                                                                                    • GetDlgCtrlID.USER32 ref: 0072B997
                                                                                                                    • GetParent.USER32 ref: 0072B9B3
                                                                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 0072B9B6
                                                                                                                    • GetDlgCtrlID.USER32(?), ref: 0072B9BF
                                                                                                                    • GetParent.USER32(?), ref: 0072B9DB
                                                                                                                    • SendMessageW.USER32(00000000,?,?,00000111), ref: 0072B9DE
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$CtrlParent
                                                                                                                    • String ID: ComboBox$ListBox
                                                                                                                    • API String ID: 1383977212-1403004172
                                                                                                                    • Opcode ID: fa151752fe5fc9acb8f3ff4a09ad186e08d23ea147e0be78fe5361bae8905cc5
                                                                                                                    • Instruction ID: 3c721fa4bef2cff1ac0003c2400df794e050004c142a1bd78db47c0003e3260f
                                                                                                                    • Opcode Fuzzy Hash: fa151752fe5fc9acb8f3ff4a09ad186e08d23ea147e0be78fe5361bae8905cc5
                                                                                                                    • Instruction Fuzzy Hash: 0C21D3B4900108FFDB04ABA4DC86EBEBB75EF49350F10411AF655A32E2DB785856DB24
                                                                                                                    Function 0072B9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 0072BA73
                                                                                                                    • GetDlgCtrlID.USER32 ref: 0072BA7E
                                                                                                                    • GetParent.USER32 ref: 0072BA9A
                                                                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 0072BA9D
                                                                                                                    • GetDlgCtrlID.USER32(?), ref: 0072BAA6
                                                                                                                    • GetParent.USER32(?), ref: 0072BAC2
                                                                                                                    • SendMessageW.USER32(00000000,?,?,00000111), ref: 0072BAC5
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$CtrlParent
                                                                                                                    • String ID: ComboBox$ListBox
                                                                                                                    • API String ID: 1383977212-1403004172
                                                                                                                    • Opcode ID: e9e0391be5aa9433b786d0bfe1832baee8ffe563fce583fccd4685fb8e244639
                                                                                                                    • Instruction ID: 37101860ac9fa33617f18290e369143c802151ab6c4c78599a03e53e29e372a2
                                                                                                                    • Opcode Fuzzy Hash: e9e0391be5aa9433b786d0bfe1832baee8ffe563fce583fccd4685fb8e244639
                                                                                                                    • Instruction Fuzzy Hash: 2F21F5B4900108BFDB00ABA4DC85EFEB775EF49340F008019F551A3192DB7D485A9B24
                                                                                                                    Function 0072BAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetParent.USER32 ref: 0072BAE3
                                                                                                                    • GetClassNameW.USER32(00000000,?,00000100), ref: 0072BAF8
                                                                                                                    • _wcscmp.LIBCMT ref: 0072BB0A
                                                                                                                    • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0072BB85
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ClassMessageNameParentSend_wcscmp
                                                                                                                    • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                                    • API String ID: 1704125052-3381328864
                                                                                                                    • Opcode ID: 6fd46712e6e009afc09b68d7d90e832f7ec7a54eb7f6eb13758c93b50eec3fa2
                                                                                                                    • Instruction ID: 51b9f4f715aa142e564e4af5d55349dbb30dcefb9e4d4ffdd456bb62098f3354
                                                                                                                    • Opcode Fuzzy Hash: 6fd46712e6e009afc09b68d7d90e832f7ec7a54eb7f6eb13758c93b50eec3fa2
                                                                                                                    • Instruction Fuzzy Hash: 221106F6608313F9FB206638FC0BDA637AC9F51764F204126FD09E40D6EBAD6CA25554
                                                                                                                    Function 0074B2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • VariantInit.OLEAUT32(?), ref: 0074B2D5
                                                                                                                    • CoInitialize.OLE32(00000000), ref: 0074B302
                                                                                                                    • CoUninitialize.OLE32 ref: 0074B30C
                                                                                                                    • GetRunningObjectTable.OLE32(00000000,?), ref: 0074B40C
                                                                                                                    • SetErrorMode.KERNEL32(00000001,00000029), ref: 0074B539
                                                                                                                    • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 0074B56D
                                                                                                                    • CoGetObject.OLE32(?,00000000,0077D91C,?), ref: 0074B590
                                                                                                                    • SetErrorMode.KERNEL32(00000000), ref: 0074B5A3
                                                                                                                    • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0074B623
                                                                                                                    • VariantClear.OLEAUT32(0077D91C), ref: 0074B633
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2395222682-0
                                                                                                                    • Opcode ID: c1be1316f79bfb0c21c07278e264c4b611686321ff4f124985118f3a1345add9
                                                                                                                    • Instruction ID: 4a8fc2f30724467374290d473ea0643d4799b7931a75c34e55e748b0d1408f57
                                                                                                                    • Opcode Fuzzy Hash: c1be1316f79bfb0c21c07278e264c4b611686321ff4f124985118f3a1345add9
                                                                                                                    • Instruction Fuzzy Hash: 74C100B1608305AFC710EF68C88492BB7E9FF89348F04495DF98A9B251DB75ED05CB92
                                                                                                                    Function 0071ACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __lock.LIBCMT ref: 0071ACC1
                                                                                                                      • Part of subcall function 00717CF4: __mtinitlocknum.LIBCMT ref: 00717D06
                                                                                                                      • Part of subcall function 00717CF4: EnterCriticalSection.KERNEL32(00000000,?,00717ADD,0000000D), ref: 00717D1F
                                                                                                                    • __calloc_crt.LIBCMT ref: 0071ACD2
                                                                                                                      • Part of subcall function 00716986: __calloc_impl.LIBCMT ref: 00716995
                                                                                                                      • Part of subcall function 00716986: Sleep.KERNEL32(00000000,000003BC,0070F507,?,0000000E), ref: 007169AC
                                                                                                                    • @_EH4_CallFilterFunc@8.LIBCMT ref: 0071ACED
                                                                                                                    • GetStartupInfoW.KERNEL32(?,007A6E28,00000064,00715E91,007A6C70,00000014), ref: 0071AD46
                                                                                                                    • __calloc_crt.LIBCMT ref: 0071AD91
                                                                                                                    • GetFileType.KERNEL32(00000001), ref: 0071ADD8
                                                                                                                    • InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 0071AE11
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1426640281-0
                                                                                                                    • Opcode ID: 2eeea97b97f923a5900764afdac696e7e2fbca9b92fab7a07f492287c92d9418
                                                                                                                    • Instruction ID: 0200edf940c69552290b50f290fd441c4ef173803d0ba1191fdcf5520644fb5b
                                                                                                                    • Opcode Fuzzy Hash: 2eeea97b97f923a5900764afdac696e7e2fbca9b92fab7a07f492287c92d9418
                                                                                                                    • Instruction Fuzzy Hash: F281B0B09066459FDB24CF6CC8456E9BBF4AF05320B24835DD4A6AB3D1D7389883CB55
                                                                                                                    Function 00734025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00734047
                                                                                                                    • GetForegroundWindow.USER32(00000000,?,?,?,?,?,007330A5,?,00000001), ref: 0073405B
                                                                                                                    • GetWindowThreadProcessId.USER32(00000000), ref: 00734062
                                                                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007330A5,?,00000001), ref: 00734071
                                                                                                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00734083
                                                                                                                    • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,007330A5,?,00000001), ref: 0073409C
                                                                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007330A5,?,00000001), ref: 007340AE
                                                                                                                    • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,007330A5,?,00000001), ref: 007340F3
                                                                                                                    • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,007330A5,?,00000001), ref: 00734108
                                                                                                                    • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,007330A5,?,00000001), ref: 00734113
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2156557900-0
                                                                                                                    • Opcode ID: 6d18ae4c144ac97756dc4e865a37cba96b1533243e875a728e2001edd927678e
                                                                                                                    • Instruction ID: abb65851108189a44b883299bf47bda30c6be211b3a2df07fab15179053c8465
                                                                                                                    • Opcode Fuzzy Hash: 6d18ae4c144ac97756dc4e865a37cba96b1533243e875a728e2001edd927678e
                                                                                                                    • Instruction Fuzzy Hash: 62318471500618ABEB28DB54DC49F697BB9AF54391F10C215F904D6291C77CEEC08B68
                                                                                                                    Function 0076DD4A Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetSysColor.USER32(00000008), ref: 0070B496
                                                                                                                    • SetTextColor.GDI32(?,000000FF), ref: 0070B4A0
                                                                                                                    • SetBkMode.GDI32(?,00000001), ref: 0070B4B5
                                                                                                                    • GetStockObject.GDI32(00000005), ref: 0070B4BD
                                                                                                                    • GetClientRect.USER32(?), ref: 0076DD63
                                                                                                                    • SendMessageW.USER32(?,00001328,00000000,?), ref: 0076DD7A
                                                                                                                    • GetWindowDC.USER32(?), ref: 0076DD86
                                                                                                                    • GetPixel.GDI32(00000000,?,?), ref: 0076DD95
                                                                                                                    • ReleaseDC.USER32(?,00000000), ref: 0076DDA7
                                                                                                                    • GetSysColor.USER32(00000005), ref: 0076DDC5
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3430376129-0
                                                                                                                    • Opcode ID: 493b034872ff978e5a80459073ab5a02fbb99ac22c24105a8cc1822fb835047d
                                                                                                                    • Instruction ID: cfabb066cb285cc1aeca2c3657443105e8f931387a0ea446883ae186635cb247
                                                                                                                    • Opcode Fuzzy Hash: 493b034872ff978e5a80459073ab5a02fbb99ac22c24105a8cc1822fb835047d
                                                                                                                    • Instruction Fuzzy Hash: 39117F31500205EFDB316BB4EC08BA93BB1EF04365F518621FA6AA50E1DB3A0E91DF14
                                                                                                                    Function 006F3093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 006F30DC
                                                                                                                    • CoUninitialize.OLE32(?,00000000), ref: 006F3181
                                                                                                                    • UnregisterHotKey.USER32(?), ref: 006F32A9
                                                                                                                    • DestroyWindow.USER32(?), ref: 00765079
                                                                                                                    • FreeLibrary.KERNEL32(?), ref: 007650F8
                                                                                                                    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00765125
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                                                                    • String ID: close all
                                                                                                                    • API String ID: 469580280-3243417748
                                                                                                                    • Opcode ID: 82db0d68dc4d6b4e34ff57986118bb9f8b30ec1aa34881cc46e87512e67238fb
                                                                                                                    • Instruction ID: accfcddc811619b690322892b44ba0aa85321f3dcc2d7652484b677cfaedc3a5
                                                                                                                    • Opcode Fuzzy Hash: 82db0d68dc4d6b4e34ff57986118bb9f8b30ec1aa34881cc46e87512e67238fb
                                                                                                                    • Instruction Fuzzy Hash: AD913A3420021ACFC755EF24C995A78F3A5FF15304F5482ADE60AA7262DF34AE56CF58
                                                                                                                    Function 0070CB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SetWindowLongW.USER32(?,000000EB), ref: 0070CC15
                                                                                                                      • Part of subcall function 0070CCCD: GetClientRect.USER32(?,?), ref: 0070CCF6
                                                                                                                      • Part of subcall function 0070CCCD: GetWindowRect.USER32(?,?), ref: 0070CD37
                                                                                                                      • Part of subcall function 0070CCCD: ScreenToClient.USER32(?,?), ref: 0070CD5F
                                                                                                                    • GetDC.USER32 ref: 0076D137
                                                                                                                    • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0076D14A
                                                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 0076D158
                                                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 0076D16D
                                                                                                                    • ReleaseDC.USER32(?,00000000), ref: 0076D175
                                                                                                                    • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0076D200
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                                                                    • String ID: U
                                                                                                                    • API String ID: 4009187628-3372436214
                                                                                                                    • Opcode ID: 418b9452117bf966124d30dcc9ba91dc32e38cd3ca519064e953ed0ac1803ee2
                                                                                                                    • Instruction ID: 32c50ab5eaaaa6d585d343071c4e313fe14b8e48dd3a8760878d3c99b46eac09
                                                                                                                    • Opcode Fuzzy Hash: 418b9452117bf966124d30dcc9ba91dc32e38cd3ca519064e953ed0ac1803ee2
                                                                                                                    • Instruction Fuzzy Hash: 7671F130A00208DFCF368F64C895AEA3BB5FF49354F184369ED569A2A6D7388C41DF60
                                                                                                                    Function 0075ECD4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070B34E: GetWindowLongW.USER32(?,000000EB), ref: 0070B35F
                                                                                                                      • Part of subcall function 0070B63C: GetCursorPos.USER32(000000FF), ref: 0070B64F
                                                                                                                      • Part of subcall function 0070B63C: ScreenToClient.USER32(00000000,000000FF), ref: 0070B66C
                                                                                                                      • Part of subcall function 0070B63C: GetAsyncKeyState.USER32(00000001), ref: 0070B691
                                                                                                                      • Part of subcall function 0070B63C: GetAsyncKeyState.USER32(00000002), ref: 0070B69F
                                                                                                                    • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 0075ED3C
                                                                                                                    • ImageList_EndDrag.COMCTL32 ref: 0075ED42
                                                                                                                    • ReleaseCapture.USER32 ref: 0075ED48
                                                                                                                    • SetWindowTextW.USER32(?,00000000), ref: 0075EDF0
                                                                                                                    • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0075EE03
                                                                                                                    • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 0075EEDC
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                                                                                    • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                                                                                    • API String ID: 1924731296-2107944366
                                                                                                                    • Opcode ID: 3c670c4d4bf2742782a52256459d707653038e5aa9990b11488c0cf05c5cc828
                                                                                                                    • Instruction ID: a86ac24bcbb7e3381a3afa3e2e10aefd5bbc15b77793aed68174cbd24862d5e0
                                                                                                                    • Opcode Fuzzy Hash: 3c670c4d4bf2742782a52256459d707653038e5aa9990b11488c0cf05c5cc828
                                                                                                                    • Instruction Fuzzy Hash: C451CC70204304AFD314DF24CC5AFAA77E5FF88714F508A1DF985962E2DBB89948CB52
                                                                                                                    Function 007445C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007445FF
                                                                                                                    • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0074462B
                                                                                                                    • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 0074466D
                                                                                                                    • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00744682
                                                                                                                    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0074468F
                                                                                                                    • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 007446BF
                                                                                                                    • InternetCloseHandle.WININET(00000000), ref: 00744706
                                                                                                                      • Part of subcall function 00745052: GetLastError.KERNEL32(?,?,007443CC,00000000,00000000,00000001), ref: 00745067
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1241431887-3916222277
                                                                                                                    • Opcode ID: ef99942a30fb73ab4e29e77d5d3814c31e36e9ab8e2fd0cd5cb89c853bfdb9df
                                                                                                                    • Instruction ID: 220fdbc6f37523b58c00ebdc8e683e0b4e69798c342740f57c23824d7b090310
                                                                                                                    • Opcode Fuzzy Hash: ef99942a30fb73ab4e29e77d5d3814c31e36e9ab8e2fd0cd5cb89c853bfdb9df
                                                                                                                    • Instruction Fuzzy Hash: 2A419EB1501208BFEB169F60CC89FBB77ACFF09354F018026FA059A191DBB89D449BA5
                                                                                                                    Function 0074B644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetModuleFileNameW.KERNEL32(?,?,00000104,?,0078DC00), ref: 0074B715
                                                                                                                    • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0078DC00), ref: 0074B749
                                                                                                                    • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 0074B8C1
                                                                                                                    • SysFreeString.OLEAUT32(?), ref: 0074B8EB
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 560350794-0
                                                                                                                    • Opcode ID: e14a125ee295f346d0c2dea2b7529249607501880ec4505bc24cb9a9cd198585
                                                                                                                    • Instruction ID: 9667529dd8a80492b6ccc38761dd65edb32e7fb86bf4f8cd63b50e47e01224ee
                                                                                                                    • Opcode Fuzzy Hash: e14a125ee295f346d0c2dea2b7529249607501880ec4505bc24cb9a9cd198585
                                                                                                                    • Instruction Fuzzy Hash: 27F11875A00209EFCB14DFA4C888EAEB7B9FF49315F108459F905AB250DB35EE46CB90
                                                                                                                    Function 007524D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 007524F5
                                                                                                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00752688
                                                                                                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007526AC
                                                                                                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007526EC
                                                                                                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0075270E
                                                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0075286F
                                                                                                                    • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 007528A1
                                                                                                                    • CloseHandle.KERNEL32(?), ref: 007528D0
                                                                                                                    • CloseHandle.KERNEL32(?), ref: 00752947
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4090791747-0
                                                                                                                    • Opcode ID: badec734ccd302857507f7a2da4db3b8babfca792f36317a9c9629f0525aaea1
                                                                                                                    • Instruction ID: 01c6f6b49710b629b2562206a93647536bb750be2e4279506b1837e58a8d81b7
                                                                                                                    • Opcode Fuzzy Hash: badec734ccd302857507f7a2da4db3b8babfca792f36317a9c9629f0525aaea1
                                                                                                                    • Instruction Fuzzy Hash: BAD1D131604300DFC714EF24C895AAEBBE5BF85310F14855DF9899B2A2DB79EC46CB92
                                                                                                                    Function 0075B33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0075B3F4
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InvalidateRect
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 634782764-0
                                                                                                                    • Opcode ID: e259937b26e0477c401f58c000932f52fca71268c1b803d5da8e9ee3fcd7ce22
                                                                                                                    • Instruction ID: eccf2e852a5e95e2126fc0d92e558fa799db84a6045704dafa9b593381d8f63a
                                                                                                                    • Opcode Fuzzy Hash: e259937b26e0477c401f58c000932f52fca71268c1b803d5da8e9ee3fcd7ce22
                                                                                                                    • Instruction Fuzzy Hash: 5351AF30500248FBEF349F28CC89BF97B64EB05366F648111FE14E61E2D7F9E9988A50
                                                                                                                    Function 0070A699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0076DB1B
                                                                                                                    • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0076DB3C
                                                                                                                    • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0076DB51
                                                                                                                    • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0076DB6E
                                                                                                                    • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0076DB95
                                                                                                                    • DestroyIcon.USER32(00000000,?,?,?,?,?,?,0070A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0076DBA0
                                                                                                                    • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0076DBBD
                                                                                                                    • DestroyIcon.USER32(00000000,?,?,?,?,?,?,0070A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0076DBC8
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1268354404-0
                                                                                                                    • Opcode ID: 0391cf195c5112c206b3a3ad4b6cbef94e712d94a15ac6088b7db65c261d686a
                                                                                                                    • Instruction ID: 45139140a1c49886fe3710f4ec634e1e4fa908aeb283c180ba8f210a3987b924
                                                                                                                    • Opcode Fuzzy Hash: 0391cf195c5112c206b3a3ad4b6cbef94e712d94a15ac6088b7db65c261d686a
                                                                                                                    • Instruction Fuzzy Hash: BA517A70A10308EFDB20DF68CC95FAA77F5EB48354F108618F90A962D0D7B8AD80CB50
                                                                                                                    Function 00737555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00736EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00735FA6,?), ref: 00736ED8
                                                                                                                      • Part of subcall function 00736EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00735FA6,?), ref: 00736EF1
                                                                                                                      • Part of subcall function 007372CB: GetFileAttributesW.KERNEL32(?,00736019), ref: 007372CC
                                                                                                                    • lstrcmpiW.KERNEL32(?,?), ref: 007375CA
                                                                                                                    • _wcscmp.LIBCMT ref: 007375E2
                                                                                                                    • MoveFileW.KERNEL32(?,?), ref: 007375FB
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 793581249-0
                                                                                                                    • Opcode ID: 5507ab439738539b475c371b82f27db6152ff4107a68653cdcc167f7548f086f
                                                                                                                    • Instruction ID: d4cc5cdcff48fd169f1d4d1b39929089edc0561c4d4631ef276c9cc050e5b1b4
                                                                                                                    • Opcode Fuzzy Hash: 5507ab439738539b475c371b82f27db6152ff4107a68653cdcc167f7548f086f
                                                                                                                    • Instruction Fuzzy Hash: 495111F2A492199AEF64EB94D8459DE73BCAF48310F00419AF605E3142EA7896C5CFB4
                                                                                                                    Function 0070EA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0076DAD1,00000004,00000000,00000000), ref: 0070EAEB
                                                                                                                    • ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,0076DAD1,00000004,00000000,00000000), ref: 0070EB32
                                                                                                                    • ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,0076DAD1,00000004,00000000,00000000), ref: 0076DC86
                                                                                                                    • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0076DAD1,00000004,00000000,00000000), ref: 0076DCF2
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ShowWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1268545403-0
                                                                                                                    • Opcode ID: 43109f3a0b06445477d20b1948fa55fa7984ed8cd4474fd15d4369522e5c497e
                                                                                                                    • Instruction ID: ce3cf8cc1f6811c7f07e7d45e35c6263f209310338b53fee8702254c4e2fda91
                                                                                                                    • Opcode Fuzzy Hash: 43109f3a0b06445477d20b1948fa55fa7984ed8cd4474fd15d4369522e5c497e
                                                                                                                    • Instruction Fuzzy Hash: C641E4B0715680DED7394B288D8DF7A7AD6AF45304F594E09E08BC69E1C67CBC80D721
                                                                                                                    Function 0072B263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0072AEF1,00000B00,?,?), ref: 0072B26C
                                                                                                                    • HeapAlloc.KERNEL32(00000000,?,0072AEF1,00000B00,?,?), ref: 0072B273
                                                                                                                    • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0072AEF1,00000B00,?,?), ref: 0072B288
                                                                                                                    • GetCurrentProcess.KERNEL32(?,00000000,?,0072AEF1,00000B00,?,?), ref: 0072B290
                                                                                                                    • DuplicateHandle.KERNEL32(00000000,?,0072AEF1,00000B00,?,?), ref: 0072B293
                                                                                                                    • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0072AEF1,00000B00,?,?), ref: 0072B2A3
                                                                                                                    • GetCurrentProcess.KERNEL32(0072AEF1,00000000,?,0072AEF1,00000B00,?,?), ref: 0072B2AB
                                                                                                                    • DuplicateHandle.KERNEL32(00000000,?,0072AEF1,00000B00,?,?), ref: 0072B2AE
                                                                                                                    • CreateThread.KERNEL32(00000000,00000000,0072B2D4,00000000,00000000,00000000), ref: 0072B2C8
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1957940570-0
                                                                                                                    • Opcode ID: fd2ac13dfa130818565c5170e7a63bc9c3669fc9dfab9dd3a6493b499bc7c998
                                                                                                                    • Instruction ID: f3d487a465135ff891ccbed06e3980286efa9be8ca82f12a31f335d417f71979
                                                                                                                    • Opcode Fuzzy Hash: fd2ac13dfa130818565c5170e7a63bc9c3669fc9dfab9dd3a6493b499bc7c998
                                                                                                                    • Instruction Fuzzy Hash: 8701ACB5240308FFE620ABA5DC49F6B7BACEB88751F418411FA09DB191CAB49C408B65
                                                                                                                    Function 0074C43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID: NULL Pointer assignment$Not an Object type
                                                                                                                    • API String ID: 0-572801152
                                                                                                                    • Opcode ID: 05214374e31b844eb21d023481c7c22cf8a5796a20e71f3db122a2be3f362631
                                                                                                                    • Instruction ID: e923889a8a7c804af59ea9d364fd5c4b4636fb85d2ac1cbfc7e636c57ac71ee4
                                                                                                                    • Opcode Fuzzy Hash: 05214374e31b844eb21d023481c7c22cf8a5796a20e71f3db122a2be3f362631
                                                                                                                    • Instruction Fuzzy Hash: 9CE1F671A01219AFDF52DFA8C885BAE77B9EF48354F148029F905AB281D778ED41CF90
                                                                                                                    Function 007416DA Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 309COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F936C: __swprintf.LIBCMT ref: 006F93AB
                                                                                                                      • Part of subcall function 006F936C: __itow.LIBCMT ref: 006F93DF
                                                                                                                      • Part of subcall function 0070C6F4: _wcscpy.LIBCMT ref: 0070C717
                                                                                                                    • _wcstok.LIBCMT ref: 0074184E
                                                                                                                    • _wcscpy.LIBCMT ref: 007418DD
                                                                                                                    • _memset.LIBCMT ref: 00741910
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                                                                                    • String ID: X$p2zl2z
                                                                                                                    • API String ID: 774024439-272593501
                                                                                                                    • Opcode ID: 9cc5bcc7d14947169feff46370e0b16fe280a6fc1de4b9c69026f027f38a90fa
                                                                                                                    • Instruction ID: 7f5159ad1b31facbabec184cdf48e265027b729d423fdb0722f71fafb45a9381
                                                                                                                    • Opcode Fuzzy Hash: 9cc5bcc7d14947169feff46370e0b16fe280a6fc1de4b9c69026f027f38a90fa
                                                                                                                    • Instruction Fuzzy Hash: B4C1A231604344DFC764EF24C945A6AB7E5BF85350F00892DFA89972A2DB34ED45CB86
                                                                                                                    Function 00759A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00759B19
                                                                                                                    • SendMessageW.USER32(?,00001036,00000000,?), ref: 00759B2D
                                                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00759B47
                                                                                                                    • _wcscat.LIBCMT ref: 00759BA2
                                                                                                                    • SendMessageW.USER32(?,00001057,00000000,?), ref: 00759BB9
                                                                                                                    • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00759BE7
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$Window_wcscat
                                                                                                                    • String ID: SysListView32
                                                                                                                    • API String ID: 307300125-78025650
                                                                                                                    • Opcode ID: 3d8abadd9d41633f9a38516a327c5b8537e094d522b9f934feb5f39c9d059764
                                                                                                                    • Instruction ID: 6b77a3bce8bf7e4e9217a230a1e66413cd74aa09899f5d532554d29d18776527
                                                                                                                    • Opcode Fuzzy Hash: 3d8abadd9d41633f9a38516a327c5b8537e094d522b9f934feb5f39c9d059764
                                                                                                                    • Instruction Fuzzy Hash: EC41A670900308EBDB219F64DC85FEE77B9EF08351F104529FA49E7191D6B99D88CB64
                                                                                                                    Function 0075172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00736532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00736554
                                                                                                                      • Part of subcall function 00736532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00736564
                                                                                                                      • Part of subcall function 00736532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 007365F9
                                                                                                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0075179A
                                                                                                                    • GetLastError.KERNEL32 ref: 007517AD
                                                                                                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 007517D9
                                                                                                                    • TerminateProcess.KERNEL32(00000000,00000000), ref: 00751855
                                                                                                                    • GetLastError.KERNEL32(00000000), ref: 00751860
                                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 00751895
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                                                                                    • String ID: SeDebugPrivilege
                                                                                                                    • API String ID: 2533919879-2896544425
                                                                                                                    • Opcode ID: 354e27fa48dfb9811b507e230b87fe83df9e0f48e4f52ea4b9cb1b2c7d26c613
                                                                                                                    • Instruction ID: 7158c71884f09d9b1147c2930cefabd6108f7ec679608fc562c617ef4c378fef
                                                                                                                    • Opcode Fuzzy Hash: 354e27fa48dfb9811b507e230b87fe83df9e0f48e4f52ea4b9cb1b2c7d26c613
                                                                                                                    • Instruction Fuzzy Hash: 5341B072600201EFEB15EF54C899FAE77A1AF44312F058058F9069F2C2DBBDAD49CB95
                                                                                                                    Function 00735819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadIconW.USER32(00000000,00007F03), ref: 007358B8
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: IconLoad
                                                                                                                    • String ID: blank$info$question$stop$warning
                                                                                                                    • API String ID: 2457776203-404129466
                                                                                                                    • Opcode ID: 49ba5878c740fce31e88dbe20593dd61e4ed58cc468842cd433d680128e551eb
                                                                                                                    • Instruction ID: 53f50d4dd2dec8c139e4753d269fa5e3547d42527c835f54c97696eccdb525bc
                                                                                                                    • Opcode Fuzzy Hash: 49ba5878c740fce31e88dbe20593dd61e4ed58cc468842cd433d680128e551eb
                                                                                                                    • Instruction Fuzzy Hash: 55110D72609742FAF7155F549C83DEA63DCAF55714F20003AF501E52C3E7ACAA8142A4
                                                                                                                    Function 0073A729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 0073A806
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ArraySafeVartype
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1725837607-0
                                                                                                                    • Opcode ID: fc5a7c7a374329ea1233b8ab474af86be6ce7026f255b4c5d44eeef29aae2085
                                                                                                                    • Instruction ID: 28da35b7b7a8f579f98990eb316780c4660f1bb1d2f2273187265d244f9c3c76
                                                                                                                    • Opcode Fuzzy Hash: fc5a7c7a374329ea1233b8ab474af86be6ce7026f255b4c5d44eeef29aae2085
                                                                                                                    • Instruction Fuzzy Hash: 63C19375A04219EFEB14CF94C486BAEB7F4FF08315F208469E685E7282D739A941CF91
                                                                                                                    Function 00736B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00736B63
                                                                                                                    • LoadStringW.USER32(00000000), ref: 00736B6A
                                                                                                                    • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00736B80
                                                                                                                    • LoadStringW.USER32(00000000), ref: 00736B87
                                                                                                                    • _wprintf.LIBCMT ref: 00736BAD
                                                                                                                    • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00736BCB
                                                                                                                    Strings
                                                                                                                    • %s (%d) : ==> %s: %s %s, xrefs: 00736BA8
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HandleLoadModuleString$Message_wprintf
                                                                                                                    • String ID: %s (%d) : ==> %s: %s %s
                                                                                                                    • API String ID: 3648134473-3128320259
                                                                                                                    • Opcode ID: 492afbaa57d11e5b48b4abcabe04343d48cbbad24c2c44ea2edf9ec26481c480
                                                                                                                    • Instruction ID: af9564532406befc2ae13ae5d1494dd26c1655398b9d3e72d5130192b611ac14
                                                                                                                    • Opcode Fuzzy Hash: 492afbaa57d11e5b48b4abcabe04343d48cbbad24c2c44ea2edf9ec26481c480
                                                                                                                    • Instruction Fuzzy Hash: AA0136F6500208BFEB21AB949D89EF7777CDB08344F4084A1B749E6041EA789EC48F74
                                                                                                                    Function 00752B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00753C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00752BB5,?,?), ref: 00753C1D
                                                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00752BF6
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: BuffCharConnectRegistryUpper
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2595220575-0
                                                                                                                    • Opcode ID: fac649c1369472ed1102a466abf9b174a977f52088e99561cb40a92aaa883ceb
                                                                                                                    • Instruction ID: 987fe6c9ad1b8c7dcd83e94d8a2965afb1632cfca06404a131b1fddf4016308d
                                                                                                                    • Opcode Fuzzy Hash: fac649c1369472ed1102a466abf9b174a977f52088e99561cb40a92aaa883ceb
                                                                                                                    • Instruction Fuzzy Hash: 47918B71204205DFCB10EF14C885BAEB7F5BF49310F04881DF9969B2A2DB78E94ACB46
                                                                                                                    Function 007495BF Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • select.WSOCK32 ref: 00749691
                                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 0074969E
                                                                                                                    • __WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 007496C8
                                                                                                                    • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 007496E9
                                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 007496F8
                                                                                                                    • htons.WSOCK32(?,?,?,00000000,?), ref: 007497AA
                                                                                                                    • inet_ntoa.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,0078DC00), ref: 00749765
                                                                                                                      • Part of subcall function 0072D2FF: _strlen.LIBCMT ref: 0072D309
                                                                                                                    • _strlen.LIBCMT ref: 00749800
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorLast_strlen$htonsinet_ntoaselect
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3480843537-0
                                                                                                                    • Opcode ID: 956c02a863d27ff3eece0c3fc3b044d88617ee051b5c7dff3f091be34a614f27
                                                                                                                    • Instruction ID: 873882f82bd3d7f54ac75528ad84a08e948a9e47c944e3da566e2772bef65b49
                                                                                                                    • Opcode Fuzzy Hash: 956c02a863d27ff3eece0c3fc3b044d88617ee051b5c7dff3f091be34a614f27
                                                                                                                    • Instruction Fuzzy Hash: 0281BB71504200EBC724EF64CC86E6BB7E9EF85710F104A1DF6559B292EB38ED04CB96
                                                                                                                    Function 0071A979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __mtinitlocknum.LIBCMT ref: 0071A991
                                                                                                                      • Part of subcall function 00717D7C: __FF_MSGBANNER.LIBCMT ref: 00717D91
                                                                                                                      • Part of subcall function 00717D7C: __NMSG_WRITE.LIBCMT ref: 00717D98
                                                                                                                      • Part of subcall function 00717D7C: __malloc_crt.LIBCMT ref: 00717DB8
                                                                                                                    • __lock.LIBCMT ref: 0071A9A4
                                                                                                                    • __lock.LIBCMT ref: 0071A9F0
                                                                                                                    • InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,007A6DE0,00000018,00725E7B,?,00000000,00000109), ref: 0071AA0C
                                                                                                                    • EnterCriticalSection.KERNEL32(8000000C,007A6DE0,00000018,00725E7B,?,00000000,00000109), ref: 0071AA29
                                                                                                                    • LeaveCriticalSection.KERNEL32(8000000C), ref: 0071AA39
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1422805418-0
                                                                                                                    • Opcode ID: 34ab32461531dee0511e7c4fdc05f1386f75a78e45751348369284a5a8c8586b
                                                                                                                    • Instruction ID: 763f39e2aa55b89dc0865cd0cb8159ed0cdf797316186252e9992f2f964f4bf5
                                                                                                                    • Opcode Fuzzy Hash: 34ab32461531dee0511e7c4fdc05f1386f75a78e45751348369284a5a8c8586b
                                                                                                                    • Instruction Fuzzy Hash: 964139B1A02205EBEB249F6CD9447DCB7B06F01724F14C319E425AB2D1D77C98C0CB95
                                                                                                                    Function 00758ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • DeleteObject.GDI32(00000000), ref: 00758EE4
                                                                                                                    • GetDC.USER32(00000000), ref: 00758EEC
                                                                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00758EF7
                                                                                                                    • ReleaseDC.USER32(00000000,00000000), ref: 00758F03
                                                                                                                    • CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00758F3F
                                                                                                                    • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00758F50
                                                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0075BD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00758F8A
                                                                                                                    • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00758FAA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3864802216-0
                                                                                                                    • Opcode ID: 2c05458a4e31335eefe6e3f9731f9a00d469b8367586ff11fd30cb6b5951f665
                                                                                                                    • Instruction ID: 414db1cc82e918a8ec0dc0ac11a22797427598d83fe90b13cd4b862770311ccf
                                                                                                                    • Opcode Fuzzy Hash: 2c05458a4e31335eefe6e3f9731f9a00d469b8367586ff11fd30cb6b5951f665
                                                                                                                    • Instruction Fuzzy Hash: F4314F72200214BFEB219F50CC4AFEA3BADEF49796F044065FE09EA191D6B99C41CB74
                                                                                                                    Function 00760133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070B34E: GetWindowLongW.USER32(?,000000EB), ref: 0070B35F
                                                                                                                    • GetSystemMetrics.USER32(0000000F), ref: 0076016D
                                                                                                                    • MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 0076038D
                                                                                                                    • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 007603AB
                                                                                                                    • InvalidateRect.USER32(?,00000000,00000001,?), ref: 007603D6
                                                                                                                    • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 007603FF
                                                                                                                    • ShowWindow.USER32(00000003,00000000), ref: 00760421
                                                                                                                    • DefDlgProcW.USER32(?,00000005,?,?), ref: 00760440
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3356174886-0
                                                                                                                    • Opcode ID: b13117290ac06a70ddcda5f8b9f53aab2694721b50163216c744824bfda97f93
                                                                                                                    • Instruction ID: 19aa0732dfb1d1f021793ad590c1ec7a6e8b3d8952eb879d7f154a6df497643c
                                                                                                                    • Opcode Fuzzy Hash: b13117290ac06a70ddcda5f8b9f53aab2694721b50163216c744824bfda97f93
                                                                                                                    • Instruction Fuzzy Hash: 02A1E135600616EFDB18CF69C9997BEBBB1FF08741F048119EC5AA7290DB38AD50CB90
                                                                                                                    Function 0070AE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 5798c96e41ac367b91cd424e0a3210eca58280041b6955849776286ee8ebdb74
                                                                                                                    • Instruction ID: ae4588dd4bf47593ae392afb29100ade6848ff173b0c13e080b6c509debb1dcd
                                                                                                                    • Opcode Fuzzy Hash: 5798c96e41ac367b91cd424e0a3210eca58280041b6955849776286ee8ebdb74
                                                                                                                    • Instruction Fuzzy Hash: BD713C71900209FFCB14CF98CC89EAEBBB5FF85314F148259F915AA291C738AA51CB65
                                                                                                                    Function 00752230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 0075225A
                                                                                                                    • _memset.LIBCMT ref: 00752323
                                                                                                                    • ShellExecuteExW.SHELL32(?), ref: 00752368
                                                                                                                      • Part of subcall function 006F936C: __swprintf.LIBCMT ref: 006F93AB
                                                                                                                      • Part of subcall function 006F936C: __itow.LIBCMT ref: 006F93DF
                                                                                                                      • Part of subcall function 0070C6F4: _wcscpy.LIBCMT ref: 0070C717
                                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0075242F
                                                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 0075243E
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
                                                                                                                    • String ID: @
                                                                                                                    • API String ID: 4082843840-2766056989
                                                                                                                    • Opcode ID: 0a36c60ffd5e838a059b8d5102babf93829d3ffde06657c976c5d74a3d38ad1a
                                                                                                                    • Instruction ID: a61f5f5bbe330a4dd43242345a80fc09980eba9c28bda75b9a9b6feac320d15d
                                                                                                                    • Opcode Fuzzy Hash: 0a36c60ffd5e838a059b8d5102babf93829d3ffde06657c976c5d74a3d38ad1a
                                                                                                                    • Instruction Fuzzy Hash: 6071D175A00619DFCF04EFA4C8859AEB7F5FF09310F108159E849AB392DB78AE45CB94
                                                                                                                    Function 00733BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetParent.USER32(00000000), ref: 00733C02
                                                                                                                    • GetKeyboardState.USER32(?), ref: 00733C17
                                                                                                                    • SetKeyboardState.USER32(?), ref: 00733C78
                                                                                                                    • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00733CA4
                                                                                                                    • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00733CC1
                                                                                                                    • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00733D05
                                                                                                                    • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00733D26
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessagePost$KeyboardState$Parent
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 87235514-0
                                                                                                                    • Opcode ID: 4370d7eccdda55bc331a0fd4fc00939e6878de60348596c9a9b81d383975b2fa
                                                                                                                    • Instruction ID: e85439fae360e7150275c1a72924bb058504191d978d331a4b1c0d0fd27bda26
                                                                                                                    • Opcode Fuzzy Hash: 4370d7eccdda55bc331a0fd4fc00939e6878de60348596c9a9b81d383975b2fa
                                                                                                                    • Instruction Fuzzy Hash: 345107A06187D53DFB3683348C56B76BFA96F06300F088489E0D95A8C3D69CEED4E760
                                                                                                                    Function 00753D72 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 00753DA1
                                                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00753DCB
                                                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 00753E80
                                                                                                                      • Part of subcall function 00753D72: RegCloseKey.ADVAPI32(?), ref: 00753DE8
                                                                                                                      • Part of subcall function 00753D72: FreeLibrary.KERNEL32(?), ref: 00753E3A
                                                                                                                      • Part of subcall function 00753D72: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00753E5D
                                                                                                                    • RegDeleteKeyW.ADVAPI32(?,?), ref: 00753E25
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 395352322-0
                                                                                                                    • Opcode ID: fa83777b351026f020a4a1b1a9a63bed7bddefa22840420cbfe253e3981d6913
                                                                                                                    • Instruction ID: 6e2486983e1db468665a8ff2e9676dc3220984f350e86d848f71a91fdfe3c9be
                                                                                                                    • Opcode Fuzzy Hash: fa83777b351026f020a4a1b1a9a63bed7bddefa22840420cbfe253e3981d6913
                                                                                                                    • Instruction Fuzzy Hash: C93110B1901109BFDB159F90DC89EFFB7BCEF08381F004169E916E2150E6B89F899B60
                                                                                                                    Function 00758FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00758FE7
                                                                                                                    • GetWindowLongW.USER32(013CF438,000000F0), ref: 0075901A
                                                                                                                    • GetWindowLongW.USER32(013CF438,000000F0), ref: 0075904F
                                                                                                                    • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00759081
                                                                                                                    • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 007590AB
                                                                                                                    • GetWindowLongW.USER32(00000000,000000F0), ref: 007590BC
                                                                                                                    • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 007590D6
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: LongWindow$MessageSend
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2178440468-0
                                                                                                                    • Opcode ID: 2442d0c2535e08ccd6abc18a1b593f507e9b55d62860a1daf110170e5b444034
                                                                                                                    • Instruction ID: a25d53c437806991bd0f6070b46d58a35a6c75e759fd45ff0bff26122ef92de8
                                                                                                                    • Opcode Fuzzy Hash: 2442d0c2535e08ccd6abc18a1b593f507e9b55d62860a1daf110170e5b444034
                                                                                                                    • Instruction Fuzzy Hash: 23311834600216DFDB208F58DC88F9437A5FB497A5F1482A4FA198B2F1CBB9AC45DB45
                                                                                                                    Function 007308AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007308F2
                                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00730918
                                                                                                                    • SysAllocString.OLEAUT32(00000000), ref: 0073091B
                                                                                                                    • SysAllocString.OLEAUT32(?), ref: 00730939
                                                                                                                    • SysFreeString.OLEAUT32(?), ref: 00730942
                                                                                                                    • StringFromGUID2.OLE32(?,?,00000028), ref: 00730967
                                                                                                                    • SysAllocString.OLEAUT32(?), ref: 00730975
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3761583154-0
                                                                                                                    • Opcode ID: ec1fdba2946981b383164f9ef12afa2bd80cdde9827835f4ccecf2f38226a4fe
                                                                                                                    • Instruction ID: b0498e1d19eb510e164b0290b14101149505795f36e25440e8da4dd84458ea07
                                                                                                                    • Opcode Fuzzy Hash: ec1fdba2946981b383164f9ef12afa2bd80cdde9827835f4ccecf2f38226a4fe
                                                                                                                    • Instruction Fuzzy Hash: 88218676601219AFEB209F68CC88EAB73BCEF09760B008125F919DB152D678EC4587A4
                                                                                                                    Function 00732472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __wcsnicmp
                                                                                                                    • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                                                    • API String ID: 1038674560-2734436370
                                                                                                                    • Opcode ID: c338081727a31022341b614376881655ca1f84540f68cd1b58e0459caaf64e52
                                                                                                                    • Instruction ID: 443705991256699ef52cfbf9128cf60ecb7404248d21f7b1bdb7791614bada13
                                                                                                                    • Opcode Fuzzy Hash: c338081727a31022341b614376881655ca1f84540f68cd1b58e0459caaf64e52
                                                                                                                    • Instruction Fuzzy Hash: 56213A72244251A7E731AA38DC16EB77398EF65310F60402AF545970C3E66D9E93C3A5
                                                                                                                    Function 00730986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007309CB
                                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007309F1
                                                                                                                    • SysAllocString.OLEAUT32(00000000), ref: 007309F4
                                                                                                                    • SysAllocString.OLEAUT32 ref: 00730A15
                                                                                                                    • SysFreeString.OLEAUT32 ref: 00730A1E
                                                                                                                    • StringFromGUID2.OLE32(?,?,00000028), ref: 00730A38
                                                                                                                    • SysAllocString.OLEAUT32(?), ref: 00730A46
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3761583154-0
                                                                                                                    • Opcode ID: 0f3326e1909e03469ed67a1a415d1a89e3390b4f47e4bd5e20f19f0f963ebc42
                                                                                                                    • Instruction ID: d845ab1cbf1115775b33a99009749083c486bb2ee85c660e0ee0e55e3b039655
                                                                                                                    • Opcode Fuzzy Hash: 0f3326e1909e03469ed67a1a415d1a89e3390b4f47e4bd5e20f19f0f963ebc42
                                                                                                                    • Instruction Fuzzy Hash: A6216B75600214AFEB20DFB8DC99D6B77ECEF08360B44C125F949CB2A1E678EC818754
                                                                                                                    Function 0075A2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0070D1BA
                                                                                                                      • Part of subcall function 0070D17C: GetStockObject.GDI32(00000011), ref: 0070D1CE
                                                                                                                      • Part of subcall function 0070D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0070D1D8
                                                                                                                    • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 0075A32D
                                                                                                                    • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0075A33A
                                                                                                                    • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0075A345
                                                                                                                    • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 0075A354
                                                                                                                    • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 0075A360
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$CreateObjectStockWindow
                                                                                                                    • String ID: Msctls_Progress32
                                                                                                                    • API String ID: 1025951953-3636473452
                                                                                                                    • Opcode ID: 33360119021a7dcc9d4dad9bc259c2a7e3c5820b8c9cd963b478557664289c57
                                                                                                                    • Instruction ID: 018504957a4bd24ebb4b377ace5eee919d86f7abcd0d65a903c569e106a5b463
                                                                                                                    • Opcode Fuzzy Hash: 33360119021a7dcc9d4dad9bc259c2a7e3c5820b8c9cd963b478557664289c57
                                                                                                                    • Instruction Fuzzy Hash: 241193B1150219BEEF155F64CC85EE77F6DFF09798F014214FA08A60A0C6769C25DBA4
                                                                                                                    Function 0070CCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetClientRect.USER32(?,?), ref: 0070CCF6
                                                                                                                    • GetWindowRect.USER32(?,?), ref: 0070CD37
                                                                                                                    • ScreenToClient.USER32(?,?), ref: 0070CD5F
                                                                                                                    • GetClientRect.USER32(?,?), ref: 0070CE8C
                                                                                                                    • GetWindowRect.USER32(?,?), ref: 0070CEA5
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Rect$Client$Window$Screen
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1296646539-0
                                                                                                                    • Opcode ID: 9749783078ae63e8f31c1e4b11627027623cd99dd74e4a00398b1b203a3a86af
                                                                                                                    • Instruction ID: 64f90aa8391c1ef185a8bf17fee1f5affc3429cf1d9cd0433346f8f2e5eafadc
                                                                                                                    • Opcode Fuzzy Hash: 9749783078ae63e8f31c1e4b11627027623cd99dd74e4a00398b1b203a3a86af
                                                                                                                    • Instruction Fuzzy Hash: 26B13879A00249DBDB15CFA8C5807EEB7F1FF08350F148629EC59AB290DB78A950DB64
                                                                                                                    Function 00751BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateToolhelp32Snapshot.KERNEL32 ref: 00751C18
                                                                                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 00751C26
                                                                                                                    • __wsplitpath.LIBCMT ref: 00751C54
                                                                                                                      • Part of subcall function 00711DFC: __wsplitpath_helper.LIBCMT ref: 00711E3C
                                                                                                                    • _wcscat.LIBCMT ref: 00751C69
                                                                                                                    • Process32NextW.KERNEL32(00000000,?), ref: 00751CDF
                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00751CF1
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1380811348-0
                                                                                                                    • Opcode ID: ea39cc767b4ee89cefd3bce5be630de59359484194c1fb66bd0f55a4f4f5668c
                                                                                                                    • Instruction ID: 96546ae83d358839a577c0c500c5f8581d912dd4eaa97d50863905de1f5a5b07
                                                                                                                    • Opcode Fuzzy Hash: ea39cc767b4ee89cefd3bce5be630de59359484194c1fb66bd0f55a4f4f5668c
                                                                                                                    • Instruction Fuzzy Hash: 5B517F711043049FD720EF24C885EABB7ECEF88754F40491EF98997291DB749945CBA6
                                                                                                                    Function 00752FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00753C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00752BB5,?,?), ref: 00753C1D
                                                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007530AF
                                                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007530EF
                                                                                                                    • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00753112
                                                                                                                    • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0075313B
                                                                                                                    • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0075317E
                                                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 0075318B
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3451389628-0
                                                                                                                    • Opcode ID: 3f4741f3b406c23ba99996d41ee2741700643e6ac24a689236698dde1ac2e939
                                                                                                                    • Instruction ID: a68f797e83b7bca5e70b866fb18ce3181b0bf7226b1375d3a9b9c90843417121
                                                                                                                    • Opcode Fuzzy Hash: 3f4741f3b406c23ba99996d41ee2741700643e6ac24a689236698dde1ac2e939
                                                                                                                    • Instruction Fuzzy Hash: 21516B31104308AFC710EF64C885EAAB7FAFF88350F04491DFA45972A1DB75EA09CB56
                                                                                                                    Function 007584DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetMenu.USER32(?), ref: 00758540
                                                                                                                    • GetMenuItemCount.USER32(00000000), ref: 00758577
                                                                                                                    • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0075859F
                                                                                                                    • GetMenuItemID.USER32(?,?), ref: 0075860E
                                                                                                                    • GetSubMenu.USER32(?,?), ref: 0075861C
                                                                                                                    • PostMessageW.USER32(?,00000111,?,00000000), ref: 0075866D
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Menu$Item$CountMessagePostString
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 650687236-0
                                                                                                                    • Opcode ID: ed13d9cc9ce2b1ea459a30e0d0f1fc8ac866d3376ab3a940afad1d8787a145af
                                                                                                                    • Instruction ID: 5e2152b218127aa09f60fd69f15e1f06e456e4c65de2fdb5ff123de8f814e6a5
                                                                                                                    • Opcode Fuzzy Hash: ed13d9cc9ce2b1ea459a30e0d0f1fc8ac866d3376ab3a940afad1d8787a145af
                                                                                                                    • Instruction Fuzzy Hash: 0051CD71A00219EFCB51EF64C845AEEB7F5EF08310F104459ED05BB352DB78AE458B95
                                                                                                                    Function 00734AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 00734B10
                                                                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00734B5B
                                                                                                                    • IsMenu.USER32(00000000), ref: 00734B7B
                                                                                                                    • CreatePopupMenu.USER32 ref: 00734BAF
                                                                                                                    • GetMenuItemCount.USER32(000000FF), ref: 00734C0D
                                                                                                                    • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00734C3E
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3311875123-0
                                                                                                                    • Opcode ID: f4d945ee8d6600324b6679e2c75b130b4be971590496ea0ef27b33077a4a6569
                                                                                                                    • Instruction ID: 45014df5928358fbd4e2a067ece7c4e2c6a4ca9f92758fb11801649923cb519e
                                                                                                                    • Opcode Fuzzy Hash: f4d945ee8d6600324b6679e2c75b130b4be971590496ea0ef27b33077a4a6569
                                                                                                                    • Instruction Fuzzy Hash: 4651F5B0601309EFEF28CF64D888BADBBF4AF44314F148159E4559B292D379AD44CB65
                                                                                                                    Function 00748DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,0078DC00), ref: 00748E7C
                                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00748E89
                                                                                                                    • __WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 00748EAD
                                                                                                                    • #16.WSOCK32(?,?,00000000,00000000), ref: 00748EC5
                                                                                                                    • _strlen.LIBCMT ref: 00748EF7
                                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00748F6A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorLast$_strlenselect
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2217125717-0
                                                                                                                    • Opcode ID: 7eafa7fde083e8dc1d97d81b98eb3c9238008bf0bb8aa51bf9fa3c860162367b
                                                                                                                    • Instruction ID: 11d560d916a1d66198cd76d3d80ef031d408a6fdcdd2d5f87dc86bbd0c4d3477
                                                                                                                    • Opcode Fuzzy Hash: 7eafa7fde083e8dc1d97d81b98eb3c9238008bf0bb8aa51bf9fa3c860162367b
                                                                                                                    • Instruction Fuzzy Hash: A641D471500108AFCB54EB64CD86EEEB7BAAF18310F104259F51A972D1DF38AE44CB65
                                                                                                                    Function 0070ABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070B34E: GetWindowLongW.USER32(?,000000EB), ref: 0070B35F
                                                                                                                    • BeginPaint.USER32(?,?,?), ref: 0070AC2A
                                                                                                                    • GetWindowRect.USER32(?,?), ref: 0070AC8E
                                                                                                                    • ScreenToClient.USER32(?,?), ref: 0070ACAB
                                                                                                                    • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0070ACBC
                                                                                                                    • EndPaint.USER32(?,?,?,?,?), ref: 0070AD06
                                                                                                                    • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0076E673
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2592858361-0
                                                                                                                    • Opcode ID: 73b715d5f45a0b01f4274639c707e53a1e8b283c433057d7c1a7ac7e6aaa8ca3
                                                                                                                    • Instruction ID: e19c3508d313fe61e82243b2b54c7e01e4781f18b1e72b3f50dc28ef97f78be7
                                                                                                                    • Opcode Fuzzy Hash: 73b715d5f45a0b01f4274639c707e53a1e8b283c433057d7c1a7ac7e6aaa8ca3
                                                                                                                    • Instruction Fuzzy Hash: 5F41AC71100301EFD720DF24C888FB77BE8AB59364F144769F9A9862E1D739A884DB62
                                                                                                                    Function 0075E397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • ShowWindow.USER32(007B1628,00000000,007B1628,00000000,00000000,007B1628,?,0076DC5D,00000000,?,00000000,00000000,00000000,?,0076DAD1,00000004), ref: 0075E40B
                                                                                                                    • EnableWindow.USER32(00000000,00000000), ref: 0075E42F
                                                                                                                    • ShowWindow.USER32(007B1628,00000000), ref: 0075E48F
                                                                                                                    • ShowWindow.USER32(00000000,00000004), ref: 0075E4A1
                                                                                                                    • EnableWindow.USER32(00000000,00000001), ref: 0075E4C5
                                                                                                                    • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0075E4E8
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$Show$Enable$MessageSend
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 642888154-0
                                                                                                                    • Opcode ID: 3a367935a9975b1db278dcfbcbd34ad07412bf0b5723dc9fd80f27a42933edcc
                                                                                                                    • Instruction ID: fb02acf271c867768e1f93cbe876f22b4d9d7165c37c972e0d8093f4b49c00f4
                                                                                                                    • Opcode Fuzzy Hash: 3a367935a9975b1db278dcfbcbd34ad07412bf0b5723dc9fd80f27a42933edcc
                                                                                                                    • Instruction Fuzzy Hash: 09412E30601184EFDB29CF24C499BD47BE1BF09346F1881A5FD5C8F1A2C7B9A989CB51
                                                                                                                    Function 007398BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • InterlockedExchange.KERNEL32(?,000001F5), ref: 007398D1
                                                                                                                      • Part of subcall function 0070F4EA: std::exception::exception.LIBCMT ref: 0070F51E
                                                                                                                      • Part of subcall function 0070F4EA: __CxxThrowException@8.LIBCMT ref: 0070F533
                                                                                                                    • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00739908
                                                                                                                    • EnterCriticalSection.KERNEL32(?), ref: 00739924
                                                                                                                    • LeaveCriticalSection.KERNEL32(?), ref: 0073999E
                                                                                                                    • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 007399B3
                                                                                                                    • InterlockedExchange.KERNEL32(?,000001F6), ref: 007399D2
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2537439066-0
                                                                                                                    • Opcode ID: 7e0781f86fa7c599c8d1a12f0994b3fd9b4b9ae44e2cc9535ebe5b805f9b03eb
                                                                                                                    • Instruction ID: 40126c361be96b2975a9887ed0cb53c9a26d7c9ae53d626bf4eb6ee05ea3bc0e
                                                                                                                    • Opcode Fuzzy Hash: 7e0781f86fa7c599c8d1a12f0994b3fd9b4b9ae44e2cc9535ebe5b805f9b03eb
                                                                                                                    • Instruction Fuzzy Hash: 2431A331A00205EBDB10EF94DC89E6EB7B8FF84310F1481A9F905AB286D778DE10CB64
                                                                                                                    Function 00749B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetForegroundWindow.USER32(?,?,?,?,?,?,007477F4,?,?,00000000,00000001), ref: 00749B53
                                                                                                                      • Part of subcall function 00746544: GetWindowRect.USER32(?,?), ref: 00746557
                                                                                                                    • GetDesktopWindow.USER32 ref: 00749B7D
                                                                                                                    • GetWindowRect.USER32(00000000), ref: 00749B84
                                                                                                                    • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00749BB6
                                                                                                                      • Part of subcall function 00737A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00737AD0
                                                                                                                    • GetCursorPos.USER32(?), ref: 00749BE2
                                                                                                                    • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00749C44
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4137160315-0
                                                                                                                    • Opcode ID: 864009100a5ceb0f6a5316c07a5664d44480a5713ee6ae8e403004d1dec500ec
                                                                                                                    • Instruction ID: c83b19dc67e722506bc881642bfe5c683cec8d209877d9b8d77aae977ce19369
                                                                                                                    • Opcode Fuzzy Hash: 864009100a5ceb0f6a5316c07a5664d44480a5713ee6ae8e403004d1dec500ec
                                                                                                                    • Instruction Fuzzy Hash: 7131E1B2104309ABD720DF18D849F9BB7E9FF88354F00092AF699E7181D735E944CB92
                                                                                                                    Function 0072AF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 0072AFAE
                                                                                                                    • OpenProcessToken.ADVAPI32(00000000), ref: 0072AFB5
                                                                                                                    • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 0072AFC4
                                                                                                                    • CloseHandle.KERNEL32(00000004), ref: 0072AFCF
                                                                                                                    • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0072AFFE
                                                                                                                    • DestroyEnvironmentBlock.USERENV(00000000), ref: 0072B012
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1413079979-0
                                                                                                                    • Opcode ID: 7a9ccce5299012316c67ce9de5cdfda50f1cdb1fa5198ff3cc476a01d4601a81
                                                                                                                    • Instruction ID: 0f126eff60f219bc8000b7bd68358c6b7d849ad2201ba36144545b0d48747b80
                                                                                                                    • Opcode Fuzzy Hash: 7a9ccce5299012316c67ce9de5cdfda50f1cdb1fa5198ff3cc476a01d4601a81
                                                                                                                    • Instruction Fuzzy Hash: 07214972100219BFDB128FA4EE09FAE7BA9EF44344F048015FA05A2161D37EDE61EB61
                                                                                                                    Function 0075EBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0070AFE3
                                                                                                                      • Part of subcall function 0070AF83: SelectObject.GDI32(?,00000000), ref: 0070AFF2
                                                                                                                      • Part of subcall function 0070AF83: BeginPath.GDI32(?), ref: 0070B009
                                                                                                                      • Part of subcall function 0070AF83: SelectObject.GDI32(?,00000000), ref: 0070B033
                                                                                                                    • MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0075EC20
                                                                                                                    • LineTo.GDI32(00000000,00000003,?), ref: 0075EC34
                                                                                                                    • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0075EC42
                                                                                                                    • LineTo.GDI32(00000000,00000000,?), ref: 0075EC52
                                                                                                                    • EndPath.GDI32(00000000), ref: 0075EC62
                                                                                                                    • StrokePath.GDI32(00000000), ref: 0075EC72
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 43455801-0
                                                                                                                    • Opcode ID: 465936b55b6ea203d726e21fd48aa6ad766811b7a67335fb4d03e26e314ba9c9
                                                                                                                    • Instruction ID: 3a60edafee369d88cda76b4af8f036aa346f5d7ed2d065976a746036a389d493
                                                                                                                    • Opcode Fuzzy Hash: 465936b55b6ea203d726e21fd48aa6ad766811b7a67335fb4d03e26e314ba9c9
                                                                                                                    • Instruction Fuzzy Hash: 2511097200014DBFEB129F90DC88EEA7F6DEF08394F048122BE0899160D7759E95DBA4
                                                                                                                    Function 0072E19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetDC.USER32(00000000), ref: 0072E1C0
                                                                                                                    • GetDeviceCaps.GDI32(00000000,00000058), ref: 0072E1D1
                                                                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0072E1D8
                                                                                                                    • ReleaseDC.USER32(00000000,00000000), ref: 0072E1E0
                                                                                                                    • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0072E1F7
                                                                                                                    • MulDiv.KERNEL32(000009EC,?,?), ref: 0072E209
                                                                                                                      • Part of subcall function 00729AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00729A05,00000000,00000000,?,00729DDB), ref: 0072A53A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CapsDevice$ExceptionRaiseRelease
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 603618608-0
                                                                                                                    • Opcode ID: 43ebc300cbb4c13be820a18053192c3b096fb8095ef57038b66d407bbce79b5d
                                                                                                                    • Instruction ID: 69ad92e79568de0af5f657e1a002d94383f333021c02c66d444f29552683d297
                                                                                                                    • Opcode Fuzzy Hash: 43ebc300cbb4c13be820a18053192c3b096fb8095ef57038b66d407bbce79b5d
                                                                                                                    • Instruction Fuzzy Hash: 570184B5A00318BFEB109BA59C45F5EBFB8EF48391F008066EA08E7390D6759C00CBA0
                                                                                                                    Function 006F27EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • MapVirtualKeyW.USER32(0000005B,00000000), ref: 006F281D
                                                                                                                    • MapVirtualKeyW.USER32(00000010,00000000), ref: 006F2825
                                                                                                                    • MapVirtualKeyW.USER32(000000A0,00000000), ref: 006F2830
                                                                                                                    • MapVirtualKeyW.USER32(000000A1,00000000), ref: 006F283B
                                                                                                                    • MapVirtualKeyW.USER32(00000011,00000000), ref: 006F2843
                                                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 006F284B
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Virtual
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4278518827-0
                                                                                                                    • Opcode ID: fbf8c1828a446ac3f230d140acd7e7dffb2ef56595520d64574f7f036ee69174
                                                                                                                    • Instruction ID: 4785be75dc6c764d3d95f92dfe8479be5c63d339b79eddf8df0c9557d3140f52
                                                                                                                    • Opcode Fuzzy Hash: fbf8c1828a446ac3f230d140acd7e7dffb2ef56595520d64574f7f036ee69174
                                                                                                                    • Instruction Fuzzy Hash: 3A016CB0901B597DE3008F6A8C85B52FFB8FF15394F00411B915C47941C7F5A864CBE5
                                                                                                                    Function 00739AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1423608774-0
                                                                                                                    • Opcode ID: 12ec77b53f00c38bfb7464c3b7f5017a31826bf84a4d807c471fb29836fcf012
                                                                                                                    • Instruction ID: 839818ca8be811d7e8e73ce653c446094e9ac761885ccb3a2867df703aa89d85
                                                                                                                    • Opcode Fuzzy Hash: 12ec77b53f00c38bfb7464c3b7f5017a31826bf84a4d807c471fb29836fcf012
                                                                                                                    • Instruction Fuzzy Hash: 1D018132202211EBE7251B94EC48DEB7779FF88741B048569F607A24A2DBBC9C41DB64
                                                                                                                    Function 00737BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00737C07
                                                                                                                    • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00737C1D
                                                                                                                    • GetWindowThreadProcessId.USER32(?,?), ref: 00737C2C
                                                                                                                    • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00737C3B
                                                                                                                    • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00737C45
                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00737C4C
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 839392675-0
                                                                                                                    • Opcode ID: e313ba99b0bd6f268c3fcf07e7b3aad0a001049d56bd5734ddde8d47e686dc33
                                                                                                                    • Instruction ID: f9260dbe7c583f4a061f7c52c658e5767f4e60275f763441d428e06e4f697563
                                                                                                                    • Opcode Fuzzy Hash: e313ba99b0bd6f268c3fcf07e7b3aad0a001049d56bd5734ddde8d47e686dc33
                                                                                                                    • Instruction Fuzzy Hash: 5CF03A72241158BBE7315B529C0EEEF7B7CEFC6B91F004028FA09D1051D7A85E81C6B9
                                                                                                                    Function 00739A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • InterlockedExchange.KERNEL32(?,?), ref: 00739A33
                                                                                                                    • EnterCriticalSection.KERNEL32(?,?,?,?,00765DEE,?,?,?,?,?,006FED63), ref: 00739A44
                                                                                                                    • TerminateThread.KERNEL32(?,000001F6,?,?,?,00765DEE,?,?,?,?,?,006FED63), ref: 00739A51
                                                                                                                    • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00765DEE,?,?,?,?,?,006FED63), ref: 00739A5E
                                                                                                                      • Part of subcall function 007393D1: CloseHandle.KERNEL32(?,?,00739A6B,?,?,?,00765DEE,?,?,?,?,?,006FED63), ref: 007393DB
                                                                                                                    • InterlockedExchange.KERNEL32(?,000001F6), ref: 00739A71
                                                                                                                    • LeaveCriticalSection.KERNEL32(?,?,?,?,00765DEE,?,?,?,?,?,006FED63), ref: 00739A78
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3495660284-0
                                                                                                                    • Opcode ID: d100050bbb76dd5efe6c0dfc38ee97f6428f8b2ccdf72c2cbfb776c47e22b60e
                                                                                                                    • Instruction ID: 27daecccc9012a7941e94987f65cc5f1a0d9df876cdc38b29c8cb792a27dd61b
                                                                                                                    • Opcode Fuzzy Hash: d100050bbb76dd5efe6c0dfc38ee97f6428f8b2ccdf72c2cbfb776c47e22b60e
                                                                                                                    • Instruction Fuzzy Hash: C6F05E32241211ABE7211BA4EC8DDAB7739FF84341F148565F607A50B2DBBD9C42DB64
                                                                                                                    Function 006F1CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070F4EA: std::exception::exception.LIBCMT ref: 0070F51E
                                                                                                                      • Part of subcall function 0070F4EA: __CxxThrowException@8.LIBCMT ref: 0070F533
                                                                                                                    • __swprintf.LIBCMT ref: 006F1EA6
                                                                                                                    Strings
                                                                                                                    • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 006F1D49
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Exception@8Throw__swprintfstd::exception::exception
                                                                                                                    • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                                                                    • API String ID: 2125237772-557222456
                                                                                                                    • Opcode ID: f3ed3e7b548093ca2c83246863638b1819d7f8a8592719f077abecf017f29d79
                                                                                                                    • Instruction ID: 212ecd1d0ab244b6240984a0b5eea912a86921f90a5ca22cb05ed85364ab993b
                                                                                                                    • Opcode Fuzzy Hash: f3ed3e7b548093ca2c83246863638b1819d7f8a8592719f077abecf017f29d79
                                                                                                                    • Instruction Fuzzy Hash: C0918F72108249DFC755EF24C895C7ABBB6BF85740F00491DFA869B2A2DB34ED04CB56
                                                                                                                    Function 0074AFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • VariantInit.OLEAUT32(?), ref: 0074B006
                                                                                                                    • CharUpperBuffW.USER32(?,?), ref: 0074B115
                                                                                                                    • VariantClear.OLEAUT32(?), ref: 0074B298
                                                                                                                      • Part of subcall function 00739DC5: VariantInit.OLEAUT32(00000000), ref: 00739E05
                                                                                                                      • Part of subcall function 00739DC5: VariantCopy.OLEAUT32(?,?), ref: 00739E0E
                                                                                                                      • Part of subcall function 00739DC5: VariantClear.OLEAUT32(?), ref: 00739E1A
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                                                                                    • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                                                                    • API String ID: 4237274167-1221869570
                                                                                                                    • Opcode ID: 18e548baf8d0a9784bffd9e5dd6a8338026accbbf3baa4221f650971f1b09f90
                                                                                                                    • Instruction ID: 2d8380affce65a87870f8f4dac7bfb783bc06cb80f6c22033088d0a144b3355f
                                                                                                                    • Opcode Fuzzy Hash: 18e548baf8d0a9784bffd9e5dd6a8338026accbbf3baa4221f650971f1b09f90
                                                                                                                    • Instruction Fuzzy Hash: 87916570608305DFCB10DF24C48596ABBE5BF89704F04896EF99A9B2A2DB35ED05CB52
                                                                                                                    Function 00735347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070C6F4: _wcscpy.LIBCMT ref: 0070C717
                                                                                                                    • _memset.LIBCMT ref: 00735438
                                                                                                                    • GetMenuItemInfoW.USER32(?), ref: 00735467
                                                                                                                    • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00735513
                                                                                                                    • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0073553D
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                                                                                    • String ID: 0
                                                                                                                    • API String ID: 4152858687-4108050209
                                                                                                                    • Opcode ID: 316f19210035a02188df5915d2814ba53d9f4ee8618c0e46c03b36cf95e20618
                                                                                                                    • Instruction ID: d86cb39b3c747940613258a090964be7c125730817842064a7686797b90b0657
                                                                                                                    • Opcode Fuzzy Hash: 316f19210035a02188df5915d2814ba53d9f4ee8618c0e46c03b36cf95e20618
                                                                                                                    • Instruction Fuzzy Hash: 685124721047019BE3149B28C8447BBB7EAAF85364F540A2DF896D31D2DB68DD408B92
                                                                                                                    Function 00730213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0073027B
                                                                                                                    • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 007302B1
                                                                                                                    • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 007302C2
                                                                                                                    • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00730344
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorMode$AddressCreateInstanceProc
                                                                                                                    • String ID: DllGetClassObject
                                                                                                                    • API String ID: 753597075-1075368562
                                                                                                                    • Opcode ID: 5a5340202feff0d97e9c3c07aac142a7e18e8979fd08316c9f07edecb21b6b00
                                                                                                                    • Instruction ID: 63d79a99982bda8085f6c365b1bcdde8d6d32b5d2ce7d71070201a1772726621
                                                                                                                    • Opcode Fuzzy Hash: 5a5340202feff0d97e9c3c07aac142a7e18e8979fd08316c9f07edecb21b6b00
                                                                                                                    • Instruction Fuzzy Hash: 12415BB1600204EFEB15CF54C8A4BAA7BB9EF45310F1480ADA9099F206D7B9DE44CBE5
                                                                                                                    Function 00735007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 00735075
                                                                                                                    • GetMenuItemInfoW.USER32 ref: 00735091
                                                                                                                    • DeleteMenu.USER32(00000004,00000007,00000000), ref: 007350D7
                                                                                                                    • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,007B1708,00000000), ref: 00735120
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Menu$Delete$InfoItem_memset
                                                                                                                    • String ID: 0
                                                                                                                    • API String ID: 1173514356-4108050209
                                                                                                                    • Opcode ID: 135dc4a803787c858653e863ba73f4217350d6c544d428ec02e0b5227a403054
                                                                                                                    • Instruction ID: 0202bed905189c403e0bebaf2c64c69dd2c317babafc27e74d23e682d2bb72f6
                                                                                                                    • Opcode Fuzzy Hash: 135dc4a803787c858653e863ba73f4217350d6c544d428ec02e0b5227a403054
                                                                                                                    • Instruction Fuzzy Hash: 9841D371204701EFE724DF28DC84B6AB7E4AF85324F144A1EF995972D2D738E940CB66
                                                                                                                    Function 00750567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CharLowerBuffW.USER32(?,?,?,?), ref: 00750587
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: BuffCharLower
                                                                                                                    • String ID: cdecl$none$stdcall$winapi
                                                                                                                    • API String ID: 2358735015-567219261
                                                                                                                    • Opcode ID: 411b281633e8716deb4e949e070f07d5d61bad1263254b932f66f4cee54b90a4
                                                                                                                    • Instruction ID: 6a252098e1690cf7e5f951429c206193cfe5e3856f0604eaed7c560e18624883
                                                                                                                    • Opcode Fuzzy Hash: 411b281633e8716deb4e949e070f07d5d61bad1263254b932f66f4cee54b90a4
                                                                                                                    • Instruction Fuzzy Hash: 5531837060011AEFCF00EF54C9419EEB3B5FF55314B10462DE825A76D1DBB9A915CB90
                                                                                                                    Function 0072B80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 0072B88E
                                                                                                                    • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 0072B8A1
                                                                                                                    • SendMessageW.USER32(?,00000189,?,00000000), ref: 0072B8D1
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend
                                                                                                                    • String ID: ComboBox$ListBox
                                                                                                                    • API String ID: 3850602802-1403004172
                                                                                                                    • Opcode ID: 4256d858a1596dee1eb20fbd762ab7525866904d2bb9272df35faad53e9122b3
                                                                                                                    • Instruction ID: 9b2f38ef78baaa1f454725e3b32152015417e24297c1b1b4f284bda18159ef18
                                                                                                                    • Opcode Fuzzy Hash: 4256d858a1596dee1eb20fbd762ab7525866904d2bb9272df35faad53e9122b3
                                                                                                                    • Instruction Fuzzy Hash: B4210172900108AFDB14ABA8EC86DBE77B9DF06360B108229F529A21E1DB7C1D068764
                                                                                                                    Function 007443E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00744401
                                                                                                                    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00744427
                                                                                                                    • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00744457
                                                                                                                    • InternetCloseHandle.WININET(00000000), ref: 0074449E
                                                                                                                      • Part of subcall function 00745052: GetLastError.KERNEL32(?,?,007443CC,00000000,00000000,00000001), ref: 00745067
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1951874230-3916222277
                                                                                                                    • Opcode ID: 96dab198fcae2a6529ffbbc874c4847fac8a9db880b358ad87f0cac9b61e1293
                                                                                                                    • Instruction ID: 4775cb62d8541609905b3be7c504cdc70c406357dc903bee6c32f06b1c56c77b
                                                                                                                    • Opcode Fuzzy Hash: 96dab198fcae2a6529ffbbc874c4847fac8a9db880b358ad87f0cac9b61e1293
                                                                                                                    • Instruction Fuzzy Hash: E62192B6500608BFE7219F68CC85FBFB6FCEF49798F10811AF109A6140DB688D45A7B1
                                                                                                                    Function 007590E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0070D1BA
                                                                                                                      • Part of subcall function 0070D17C: GetStockObject.GDI32(00000011), ref: 0070D1CE
                                                                                                                      • Part of subcall function 0070D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0070D1D8
                                                                                                                    • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 0075915C
                                                                                                                    • LoadLibraryW.KERNEL32(?), ref: 00759163
                                                                                                                    • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00759178
                                                                                                                    • DestroyWindow.USER32(?), ref: 00759180
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                                                                                    • String ID: SysAnimate32
                                                                                                                    • API String ID: 4146253029-1011021900
                                                                                                                    • Opcode ID: 40f4d5b2249c66148b8a2671127a9c573f2b8090a950862d2ce07973073d2aea
                                                                                                                    • Instruction ID: 236ae352dbb880bde7322114ca7af047e152d941b19bf742deab31b3ff1c1fcf
                                                                                                                    • Opcode Fuzzy Hash: 40f4d5b2249c66148b8a2671127a9c573f2b8090a950862d2ce07973073d2aea
                                                                                                                    • Instruction Fuzzy Hash: 8A21DE7120061AFBEF204E648C88EFA73A9EF993A5F104618FE1492190C7B9CC46A761
                                                                                                                    Function 00739568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetStdHandle.KERNEL32(0000000C), ref: 00739588
                                                                                                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007395B9
                                                                                                                    • GetStdHandle.KERNEL32(0000000C), ref: 007395CB
                                                                                                                    • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00739605
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateHandle$FilePipe
                                                                                                                    • String ID: nul
                                                                                                                    • API String ID: 4209266947-2873401336
                                                                                                                    • Opcode ID: 191fa3096ff36429522e924e2ffdfae42a20fd24f470706a36fe1a39779a6a40
                                                                                                                    • Instruction ID: 39f3c868c364bf932fd3bf67b670d7deb12ac41ef923cd0a6d532d50fa558fc2
                                                                                                                    • Opcode Fuzzy Hash: 191fa3096ff36429522e924e2ffdfae42a20fd24f470706a36fe1a39779a6a40
                                                                                                                    • Instruction Fuzzy Hash: 9D21B271600205ABFB219F25DC05A9A77F4BF45320F204A19FAA5D72D2D7B8DD91CB20
                                                                                                                    Function 00739634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetStdHandle.KERNEL32(000000F6), ref: 00739653
                                                                                                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00739683
                                                                                                                    • GetStdHandle.KERNEL32(000000F6), ref: 00739694
                                                                                                                    • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 007396CE
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateHandle$FilePipe
                                                                                                                    • String ID: nul
                                                                                                                    • API String ID: 4209266947-2873401336
                                                                                                                    • Opcode ID: 6bc85ce5344547f03988bcbde4dba3621afb60d63a5174888b92f1bb97453b01
                                                                                                                    • Instruction ID: 67ede2e29ef0561af9e8535ff0d87d49bcef82e19bb9ee0e1e9e07e0eec8580d
                                                                                                                    • Opcode Fuzzy Hash: 6bc85ce5344547f03988bcbde4dba3621afb60d63a5174888b92f1bb97453b01
                                                                                                                    • Instruction Fuzzy Hash: 8021A171601205DBEB209F698C06E9A77F8AF85720F204A18FAA1E32D2D7B89841CB14
                                                                                                                    Function 0073DAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0073DB0A
                                                                                                                    • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0073DB5E
                                                                                                                    • __swprintf.LIBCMT ref: 0073DB77
                                                                                                                    • SetErrorMode.KERNEL32(00000000,00000001,00000000,0078DC00), ref: 0073DBB5
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorMode$InformationVolume__swprintf
                                                                                                                    • String ID: %lu
                                                                                                                    • API String ID: 3164766367-685833217
                                                                                                                    • Opcode ID: ba3f2690f7ec10f593226a65564226e28c9b563fee2548bf66bac2d6741a3e88
                                                                                                                    • Instruction ID: 204a4234d8066b4df1bc7c3fbaac4da2545dd6f47911a98fbd367c3b107d3246
                                                                                                                    • Opcode Fuzzy Hash: ba3f2690f7ec10f593226a65564226e28c9b563fee2548bf66bac2d6741a3e88
                                                                                                                    • Instruction Fuzzy Hash: D921717560010CAFDB10EF64D985DAEB7B9EF89714B004069F609E7291DB74EE41CB64
                                                                                                                    Function 0072C9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0072C82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0072C84A
                                                                                                                      • Part of subcall function 0072C82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 0072C85D
                                                                                                                      • Part of subcall function 0072C82D: GetCurrentThreadId.KERNEL32 ref: 0072C864
                                                                                                                      • Part of subcall function 0072C82D: AttachThreadInput.USER32(00000000), ref: 0072C86B
                                                                                                                    • GetFocus.USER32 ref: 0072CA05
                                                                                                                      • Part of subcall function 0072C876: GetParent.USER32(?), ref: 0072C884
                                                                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 0072CA4E
                                                                                                                    • EnumChildWindows.USER32(?,0072CAC4), ref: 0072CA76
                                                                                                                    • __swprintf.LIBCMT ref: 0072CA90
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
                                                                                                                    • String ID: %s%d
                                                                                                                    • API String ID: 3187004680-1110647743
                                                                                                                    • Opcode ID: b30d0ba80b11a2cf245a1a55c2906cacc7b69987d1dc768ac75fc0d747e228dd
                                                                                                                    • Instruction ID: 41c6bf7d804def4a25d301fce89b87afc213abe8c9139f06556f9c8badd38385
                                                                                                                    • Opcode Fuzzy Hash: b30d0ba80b11a2cf245a1a55c2906cacc7b69987d1dc768ac75fc0d747e228dd
                                                                                                                    • Instruction Fuzzy Hash: ED11B7B1600219BBCB12BF64DC89FED3779AF55704F00C066FE08AA182DB789945CB75
                                                                                                                    Function 00717A94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __lock.LIBCMT ref: 00717AD8
                                                                                                                      • Part of subcall function 00717CF4: __mtinitlocknum.LIBCMT ref: 00717D06
                                                                                                                      • Part of subcall function 00717CF4: EnterCriticalSection.KERNEL32(00000000,?,00717ADD,0000000D), ref: 00717D1F
                                                                                                                    • InterlockedIncrement.KERNEL32(?), ref: 00717AE5
                                                                                                                    • __lock.LIBCMT ref: 00717AF9
                                                                                                                    • ___addlocaleref.LIBCMT ref: 00717B17
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
                                                                                                                    • String ID: `w
                                                                                                                    • API String ID: 1687444384-2147769465
                                                                                                                    • Opcode ID: 2a1a986e9678f7aa967e5167e09675c5681c97e1074e16f20acc38c352692c3e
                                                                                                                    • Instruction ID: 46b91bb54c83483ceb9cc084890be4b73cccf9701e8c827fee22596eadc492a0
                                                                                                                    • Opcode Fuzzy Hash: 2a1a986e9678f7aa967e5167e09675c5681c97e1074e16f20acc38c352692c3e
                                                                                                                    • Instruction Fuzzy Hash: 69016DB1504B00EFD730DF79D90978AF7F0AF44325F20894EA49A976E0CBB8A684CB55
                                                                                                                    Function 0075E32E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40processCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 0075E33D
                                                                                                                    • _memset.LIBCMT ref: 0075E34C
                                                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,007B3D00,007B3D44), ref: 0075E37B
                                                                                                                    • CloseHandle.KERNEL32 ref: 0075E38D
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _memset$CloseCreateHandleProcess
                                                                                                                    • String ID: D={
                                                                                                                    • API String ID: 3277943733-636296196
                                                                                                                    • Opcode ID: 6e6f90e8fb0410609a29dcd04c3bf8fae516eaf7fbd3bd2f7e9905e59eb95ebc
                                                                                                                    • Instruction ID: 089396e3f9b8dc231bb7a10d70b93bfbd2d3ad63dda8961ff951b93b40b6cb7c
                                                                                                                    • Opcode Fuzzy Hash: 6e6f90e8fb0410609a29dcd04c3bf8fae516eaf7fbd3bd2f7e9905e59eb95ebc
                                                                                                                    • Instruction Fuzzy Hash: 63F0FEF1740314BAF3105B65AC59FB77E6CDB04B54F008921BE48DA1A2D7BD9E9086AC
                                                                                                                    Function 00751945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 007519F3
                                                                                                                    • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00751A26
                                                                                                                    • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00751B49
                                                                                                                    • CloseHandle.KERNEL32(?), ref: 00751BBF
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2364364464-0
                                                                                                                    • Opcode ID: 447e58f23ed5045e32d64c90899a567e19b5009a119168df77fdbce2c50b9433
                                                                                                                    • Instruction ID: 39d8117e38a27620682796542fabd7400b36868eacba3063fd2daec0a41584be
                                                                                                                    • Opcode Fuzzy Hash: 447e58f23ed5045e32d64c90899a567e19b5009a119168df77fdbce2c50b9433
                                                                                                                    • Instruction Fuzzy Hash: 3C8164B1600214EBDF10AF64C88ABAEBBE5AF04711F14C559F905AF3C2D7B9AD45CB90
                                                                                                                    Function 0075E062 Relevance: 7.7, APIs: 5, Instructions: 187windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0075E1D5
                                                                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0075E20D
                                                                                                                    • IsDlgButtonChecked.USER32(?,00000001), ref: 0075E248
                                                                                                                    • GetWindowLongW.USER32(?,000000EC), ref: 0075E269
                                                                                                                    • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0075E281
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$ButtonCheckedLongWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3188977179-0
                                                                                                                    • Opcode ID: 1913fa569f97ccbdd25607a828d5e967cc019843eec814ae9228dcc3fbfae7ca
                                                                                                                    • Instruction ID: 527a9517ea72cb4e045a8cde295e99d1364deee56d696776f45ae15274a7b0b2
                                                                                                                    • Opcode Fuzzy Hash: 1913fa569f97ccbdd25607a828d5e967cc019843eec814ae9228dcc3fbfae7ca
                                                                                                                    • Instruction Fuzzy Hash: D561A234600608AFDB28CF14C894FEA77BAEF49311F548099FD5997391CBB9AE44CB51
                                                                                                                    Function 00731C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • VariantInit.OLEAUT32(?), ref: 00731CB4
                                                                                                                    • VariantClear.OLEAUT32(00000013), ref: 00731D26
                                                                                                                    • VariantClear.OLEAUT32(00000000), ref: 00731D81
                                                                                                                    • VariantClear.OLEAUT32(?), ref: 00731DF8
                                                                                                                    • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00731E26
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Variant$Clear$ChangeInitType
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4136290138-0
                                                                                                                    • Opcode ID: be4458c67b9d7167b3ed40de4ab95c8af6c35b63412627fc1cf008399a7efe50
                                                                                                                    • Instruction ID: 8172fa1c3cfbf881cc1d81de442b737b5938715f2029a0ed34ce0d93837eda39
                                                                                                                    • Opcode Fuzzy Hash: be4458c67b9d7167b3ed40de4ab95c8af6c35b63412627fc1cf008399a7efe50
                                                                                                                    • Instruction Fuzzy Hash: AB5166B5A00209AFDB20CF58C884AAAB7B8FF4D354F158559ED49DB305E334EA41CBA0
                                                                                                                    Function 00750688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F936C: __swprintf.LIBCMT ref: 006F93AB
                                                                                                                      • Part of subcall function 006F936C: __itow.LIBCMT ref: 006F93DF
                                                                                                                    • LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 007506EE
                                                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 0075077D
                                                                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0075079B
                                                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 007507E1
                                                                                                                    • FreeLibrary.KERNEL32(00000000,00000004), ref: 007507FB
                                                                                                                      • Part of subcall function 0070E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0073A574,?,?,00000000,00000008), ref: 0070E675
                                                                                                                      • Part of subcall function 0070E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0073A574,?,?,00000000,00000008), ref: 0070E699
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 327935632-0
                                                                                                                    • Opcode ID: c364f06921dd5018d1baeafc7ce43235d73cab206cbcefb1c39f923be3e114eb
                                                                                                                    • Instruction ID: 25af489af3d5a9d6379ff424ce83a7ae79e114daa2bc7b6ecff192af3ecb571c
                                                                                                                    • Opcode Fuzzy Hash: c364f06921dd5018d1baeafc7ce43235d73cab206cbcefb1c39f923be3e114eb
                                                                                                                    • Instruction Fuzzy Hash: AF513776A00209DFCB00EFA8C495DEDB7B6BF49310B048459EA15AB352DB78FD49CB94
                                                                                                                    Function 00752E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00753C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00752BB5,?,?), ref: 00753C1D
                                                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00752EEF
                                                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00752F2E
                                                                                                                    • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00752F75
                                                                                                                    • RegCloseKey.ADVAPI32(?,?), ref: 00752FA1
                                                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 00752FAE
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Close$BuffCharConnectEnumOpenRegistryUpper
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3740051246-0
                                                                                                                    • Opcode ID: b5249a3bfd9ef10549dc7debf26a7ad7a0f7ba80b88b76fda1021865f6ed191f
                                                                                                                    • Instruction ID: 9005adcbe0512aac6cb1c377168f9f72651fa8df4d02bac3f67d86ac990dce6c
                                                                                                                    • Opcode Fuzzy Hash: b5249a3bfd9ef10549dc7debf26a7ad7a0f7ba80b88b76fda1021865f6ed191f
                                                                                                                    • Instruction Fuzzy Hash: D9515E71208208AFD704EF54C885EAEB7F9FF88314F04881DFA559B292DB74E909CB56
                                                                                                                    Function 0075CCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: d2a026eb04b49eed832a8da90156938bfa018538d3a0d52958e960f089198e7c
                                                                                                                    • Instruction ID: ca2d494aae24baffd39f6eafee47c9babad0764caedf84d113807a0a5a983ec2
                                                                                                                    • Opcode Fuzzy Hash: d2a026eb04b49eed832a8da90156938bfa018538d3a0d52958e960f089198e7c
                                                                                                                    • Instruction Fuzzy Hash: DD41E639A00304AFD721DB68CC49FE97B78EB09351F144265FD19E72D1C7B8AD45CA94
                                                                                                                    Function 00741206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 007412B4
                                                                                                                    • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 007412DD
                                                                                                                    • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0074131C
                                                                                                                      • Part of subcall function 006F936C: __swprintf.LIBCMT ref: 006F93AB
                                                                                                                      • Part of subcall function 006F936C: __itow.LIBCMT ref: 006F93DF
                                                                                                                    • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00741341
                                                                                                                    • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00741349
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1389676194-0
                                                                                                                    • Opcode ID: 8fd55a60c38ba8bef3f56ce7a61a3821c13a1534d5a254787ca8b065c2edfebd
                                                                                                                    • Instruction ID: c07d271568e26201d8d5aa27ce2cc59cf2ea8fef44311afb02cd11b1b821fb54
                                                                                                                    • Opcode Fuzzy Hash: 8fd55a60c38ba8bef3f56ce7a61a3821c13a1534d5a254787ca8b065c2edfebd
                                                                                                                    • Instruction Fuzzy Hash: F1411C35600109DFDB01EF64C985AAEBBF5FF09314B148099E90AAB3A2CB35ED41DB64
                                                                                                                    Function 0070B63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetCursorPos.USER32(000000FF), ref: 0070B64F
                                                                                                                    • ScreenToClient.USER32(00000000,000000FF), ref: 0070B66C
                                                                                                                    • GetAsyncKeyState.USER32(00000001), ref: 0070B691
                                                                                                                    • GetAsyncKeyState.USER32(00000002), ref: 0070B69F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AsyncState$ClientCursorScreen
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4210589936-0
                                                                                                                    • Opcode ID: 881b2aaaa8a1b5662d524ea5d610f82ec802c837de17d72b2011fd7e15532d8e
                                                                                                                    • Instruction ID: c343fa733d8690b210b451755381440056832d8085711ed6b02fd9967113ee3b
                                                                                                                    • Opcode Fuzzy Hash: 881b2aaaa8a1b5662d524ea5d610f82ec802c837de17d72b2011fd7e15532d8e
                                                                                                                    • Instruction Fuzzy Hash: EB413235A04115FBDF259F64C844AEDBBB4BF05364F204315E82AA61D0CB39AE94DF91
                                                                                                                    Function 0072B358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetWindowRect.USER32(?,?), ref: 0072B369
                                                                                                                    • PostMessageW.USER32(?,00000201,00000001), ref: 0072B413
                                                                                                                    • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 0072B41B
                                                                                                                    • PostMessageW.USER32(?,00000202,00000000), ref: 0072B429
                                                                                                                    • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 0072B431
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessagePostSleep$RectWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3382505437-0
                                                                                                                    • Opcode ID: 663e108c77d9dea07c05211eb4a505c250e5ee038b77ab654280cce240672818
                                                                                                                    • Instruction ID: 1fc889f8f8e283f75a390040fd4f291a0d49f604da3336cde054a309273512d2
                                                                                                                    • Opcode Fuzzy Hash: 663e108c77d9dea07c05211eb4a505c250e5ee038b77ab654280cce240672818
                                                                                                                    • Instruction Fuzzy Hash: 6231A071900269EBDF14CF68ED4DA9E7BB5EF04325F108229F925A61D1C3B89D54CB90
                                                                                                                    Function 0072DBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • IsWindowVisible.USER32(?), ref: 0072DBD7
                                                                                                                    • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0072DBF4
                                                                                                                    • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0072DC2C
                                                                                                                    • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0072DC52
                                                                                                                    • _wcsstr.LIBCMT ref: 0072DC5C
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3902887630-0
                                                                                                                    • Opcode ID: 356ffad596cdae8ff4cc70c2daa398f3c80d3016f803892b7d15c86690d9031d
                                                                                                                    • Instruction ID: 48ad681649960630f62aa8a8ce111c966a6b2cfbb12467f8e8e7b18a698753f1
                                                                                                                    • Opcode Fuzzy Hash: 356ffad596cdae8ff4cc70c2daa398f3c80d3016f803892b7d15c86690d9031d
                                                                                                                    • Instruction Fuzzy Hash: 85210771204150BFEB355F39AC49E7B7BACDF457A0F108029F809DA191EAA9CC81D2A0
                                                                                                                    Function 0072BC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0072BC90
                                                                                                                    • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0072BCC2
                                                                                                                    • __itow.LIBCMT ref: 0072BCDA
                                                                                                                    • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0072BD00
                                                                                                                    • __itow.LIBCMT ref: 0072BD11
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$__itow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3379773720-0
                                                                                                                    • Opcode ID: 6606adc171488b20710e3f5786eb94783e1229dcf20e70ee3ec3c80d1275f97b
                                                                                                                    • Instruction ID: b16d340ef570724ac902f06e29fd2bb91b2e3214da6a1ea734e1687445305138
                                                                                                                    • Opcode Fuzzy Hash: 6606adc171488b20710e3f5786eb94783e1229dcf20e70ee3ec3c80d1275f97b
                                                                                                                    • Instruction Fuzzy Hash: 4B212B31700628BBDB20AE699C4AFDF7B79EF4A350F404024FA05EB181DB788D4587B1
                                                                                                                    Function 00736318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F50E6: _wcsncpy.LIBCMT ref: 006F50FA
                                                                                                                    • GetFileAttributesW.KERNEL32(?,?,?,?,007360C3), ref: 00736369
                                                                                                                    • GetLastError.KERNEL32(?,?,?,007360C3), ref: 00736374
                                                                                                                    • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,007360C3), ref: 00736388
                                                                                                                    • _wcsrchr.LIBCMT ref: 007363AA
                                                                                                                      • Part of subcall function 00736318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,007360C3), ref: 007363E0
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3633006590-0
                                                                                                                    • Opcode ID: 5eb87e4246703b35be74fcf22919642cbe305d975cf4a8421fb922db03089deb
                                                                                                                    • Instruction ID: 7b2f5f584edf9c8fbb1a32cde5df4a5ae7288959ef2fa0c1cdca36f506b39368
                                                                                                                    • Opcode Fuzzy Hash: 5eb87e4246703b35be74fcf22919642cbe305d975cf4a8421fb922db03089deb
                                                                                                                    • Instruction Fuzzy Hash: 2221F631505215EBFF25AB789C46FEA23ACAF053A0F108465F005D70C2EA6CDDC18A55
                                                                                                                    Function 00748B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0074A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 0074A84E
                                                                                                                    • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00748BD3
                                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00748BE2
                                                                                                                    • connect.WSOCK32(00000000,?,00000010), ref: 00748BFE
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorLastconnectinet_addrsocket
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3701255441-0
                                                                                                                    • Opcode ID: b6123ff836d32f31a88ec3be1fe73dba7cde67bea646804780499633ea3ec527
                                                                                                                    • Instruction ID: d28e38bb1ee29c76acb4e124b8b989a9d1563fcd66ef09afd0587cb17984a447
                                                                                                                    • Opcode Fuzzy Hash: b6123ff836d32f31a88ec3be1fe73dba7cde67bea646804780499633ea3ec527
                                                                                                                    • Instruction Fuzzy Hash: A221A5322001149FDB14AF68CC89F7E77E9EF48750F048559F916AB3D2CB78AC418B65
                                                                                                                    Function 00748420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • IsWindow.USER32(00000000), ref: 00748441
                                                                                                                    • GetForegroundWindow.USER32 ref: 00748458
                                                                                                                    • GetDC.USER32(00000000), ref: 00748494
                                                                                                                    • GetPixel.GDI32(00000000,?,00000003), ref: 007484A0
                                                                                                                    • ReleaseDC.USER32(00000000,00000003), ref: 007484DB
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$ForegroundPixelRelease
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4156661090-0
                                                                                                                    • Opcode ID: 168576d4724f75130b3f575872930a3097ef76a13546be0ff031448d2d53cac5
                                                                                                                    • Instruction ID: 9dd9fd964698ad56e134c027537465c25bd389ae7dc135cc937e2fc24caf1973
                                                                                                                    • Opcode Fuzzy Hash: 168576d4724f75130b3f575872930a3097ef76a13546be0ff031448d2d53cac5
                                                                                                                    • Instruction Fuzzy Hash: 2221A435A00204EFD710EFA4C849A6EB7F5EF48341F04C879E949D7252DB74AD40CBA0
                                                                                                                    Function 0070AF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0070AFE3
                                                                                                                    • SelectObject.GDI32(?,00000000), ref: 0070AFF2
                                                                                                                    • BeginPath.GDI32(?), ref: 0070B009
                                                                                                                    • SelectObject.GDI32(?,00000000), ref: 0070B033
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ObjectSelect$BeginCreatePath
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3225163088-0
                                                                                                                    • Opcode ID: 6a7f7bed5ae05e11e47534d675c2d4bf96bf91657dc2291ba3fa8eea8eaaa2bc
                                                                                                                    • Instruction ID: 61a5a5ba00f74cab44709ecbf179b663e7d7c39a2c1ebfb4d58f6fa4de51d429
                                                                                                                    • Opcode Fuzzy Hash: 6a7f7bed5ae05e11e47534d675c2d4bf96bf91657dc2291ba3fa8eea8eaaa2bc
                                                                                                                    • Instruction Fuzzy Hash: 6321D3B1800309EFCB20DF55EC58BAA3BB8BB10399F94C32AE425921E0D77D9995CF54
                                                                                                                    Function 0071217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __calloc_crt.LIBCMT ref: 007121A9
                                                                                                                    • CreateThread.KERNEL32(?,?,007122DF,00000000,?,?), ref: 007121ED
                                                                                                                    • GetLastError.KERNEL32 ref: 007121F7
                                                                                                                    • _free.LIBCMT ref: 00712200
                                                                                                                    • __dosmaperr.LIBCMT ref: 0071220B
                                                                                                                      • Part of subcall function 00717C0E: __getptd_noexit.LIBCMT ref: 00717C0E
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2664167353-0
                                                                                                                    • Opcode ID: 742b0792003d93aa5fa4412f29624b69ec4fef41e30b748452e0466149b859ef
                                                                                                                    • Instruction ID: 4d359a914bd96215d11041e2096360120c084dc4b55a297eb7234ea10a8545d3
                                                                                                                    • Opcode Fuzzy Hash: 742b0792003d93aa5fa4412f29624b69ec4fef41e30b748452e0466149b859ef
                                                                                                                    • Instruction Fuzzy Hash: 7111E53220430AEF9B25AF6C9C45DDF3BA8EF047607100429F914861C2EB79D8E296A0
                                                                                                                    Function 0072ABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0072ABD7
                                                                                                                    • GetLastError.KERNEL32(?,0072A69F,?,?,?), ref: 0072ABE1
                                                                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,0072A69F,?,?,?), ref: 0072ABF0
                                                                                                                    • HeapAlloc.KERNEL32(00000000,?,0072A69F,?,?,?), ref: 0072ABF7
                                                                                                                    • GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0072AC0E
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 842720411-0
                                                                                                                    • Opcode ID: 918725f3aba8140c2db7e04082a362a3c97a72125456fc1956bd72a9ea11b14d
                                                                                                                    • Instruction ID: 4813bc52f19d6cfc6351a8e20019b69b07c3bffabce3a5f590df96b2fa37c8ab
                                                                                                                    • Opcode Fuzzy Hash: 918725f3aba8140c2db7e04082a362a3c97a72125456fc1956bd72a9ea11b14d
                                                                                                                    • Instruction Fuzzy Hash: F3011971200214BFDB204FA9EC48DAB3BBDEF8A7957104469F949D3260DA759C80CF75
                                                                                                                    Function 00737A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00737A74
                                                                                                                    • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00737A82
                                                                                                                    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00737A8A
                                                                                                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00737A94
                                                                                                                    • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00737AD0
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2833360925-0
                                                                                                                    • Opcode ID: c11264f91bc6338d5409a346896dadd2a981d3ac2a3dd5fb8a882dd801573b0f
                                                                                                                    • Instruction ID: 22d225902d8d04f36c0fce8c84e19b8cc7f339f9186c3ac7794d5a25210fac19
                                                                                                                    • Opcode Fuzzy Hash: c11264f91bc6338d5409a346896dadd2a981d3ac2a3dd5fb8a882dd801573b0f
                                                                                                                    • Instruction Fuzzy Hash: EC018072C0461DEBDF24AFE8DC88ADDBB78FF08351F418445D502B2251DB389A90C7A5
                                                                                                                    Function 00729ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CLSIDFromProgID.OLE32 ref: 00729ADC
                                                                                                                    • ProgIDFromCLSID.OLE32(?,00000000), ref: 00729AF7
                                                                                                                    • lstrcmpiW.KERNEL32(?,00000000), ref: 00729B05
                                                                                                                    • CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00729B15
                                                                                                                    • CLSIDFromString.OLE32(?,?), ref: 00729B21
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3897988419-0
                                                                                                                    • Opcode ID: 9069a6dc4a50be9c6b64e60aac3668389d5b4e72843ca1e3dd67a16f322d1dae
                                                                                                                    • Instruction ID: 708b85f56797c7c79c275d39342da8532bc427f327f1c5180130f23a75ad579c
                                                                                                                    • Opcode Fuzzy Hash: 9069a6dc4a50be9c6b64e60aac3668389d5b4e72843ca1e3dd67a16f322d1dae
                                                                                                                    • Instruction Fuzzy Hash: 9F0162B6A00225FFDB214F54ED44B9A7BFDEF48791F188428FA09D2210D779DD409BA1
                                                                                                                    Function 0072AA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 0072AA79
                                                                                                                    • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 0072AA83
                                                                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 0072AA92
                                                                                                                    • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 0072AA99
                                                                                                                    • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0072AAAF
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 44706859-0
                                                                                                                    • Opcode ID: 12fdf4bc67e6aad7f2b37b92aceafffd18ac7bf96f256f1e497c6d520ca59da1
                                                                                                                    • Instruction ID: 728b3edfd4632314b35ed0a13ec80c27727aaecbb178f784787da59a0ed6791c
                                                                                                                    • Opcode Fuzzy Hash: 12fdf4bc67e6aad7f2b37b92aceafffd18ac7bf96f256f1e497c6d520ca59da1
                                                                                                                    • Instruction Fuzzy Hash: A5F04F71200314BFEB215FA4AC89E773BBCFF49794F108829F945D7190DA699C82CA61
                                                                                                                    Function 0072AAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0072AADA
                                                                                                                    • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0072AAE4
                                                                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0072AAF3
                                                                                                                    • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0072AAFA
                                                                                                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0072AB10
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 44706859-0
                                                                                                                    • Opcode ID: 358632fec7c2ce21738edd5ebe0159bb316b84ea76ec38a0cc584aeab3d84995
                                                                                                                    • Instruction ID: 8dfc51e272408ef63f7dfc0efea4e72190d24e2d2dac278b3df6ce3cc9f92c70
                                                                                                                    • Opcode Fuzzy Hash: 358632fec7c2ce21738edd5ebe0159bb316b84ea76ec38a0cc584aeab3d84995
                                                                                                                    • Instruction Fuzzy Hash: 8FF04F71200318BFEB210FA4EC88E773B7EFF46794F104429F945D7190CA699C41CA61
                                                                                                                    Function 0072EC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetDlgItem.USER32(?,000003E9), ref: 0072EC94
                                                                                                                    • GetWindowTextW.USER32(00000000,?,00000100), ref: 0072ECAB
                                                                                                                    • MessageBeep.USER32(00000000), ref: 0072ECC3
                                                                                                                    • KillTimer.USER32(?,0000040A), ref: 0072ECDF
                                                                                                                    • EndDialog.USER32(?,00000001), ref: 0072ECF9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3741023627-0
                                                                                                                    • Opcode ID: b67377efe62367a21a5bc8b5855769815a96182cb5ebe68c1d0b30b20d81098e
                                                                                                                    • Instruction ID: 821af1b352c89acc918c29d1c64b5a7bfa867177829c0584455f82d5d9bff8c1
                                                                                                                    • Opcode Fuzzy Hash: b67377efe62367a21a5bc8b5855769815a96182cb5ebe68c1d0b30b20d81098e
                                                                                                                    • Instruction Fuzzy Hash: 94018130500714ABEB345B50EE5EB9677B8FF00745F004559B686A14E0DBF8AED4CB94
                                                                                                                    Function 0070B0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • EndPath.GDI32(?), ref: 0070B0BA
                                                                                                                    • StrokeAndFillPath.GDI32(?,?,0076E680,00000000,?,?,?), ref: 0070B0D6
                                                                                                                    • SelectObject.GDI32(?,00000000), ref: 0070B0E9
                                                                                                                    • DeleteObject.GDI32 ref: 0070B0FC
                                                                                                                    • StrokePath.GDI32(?), ref: 0070B117
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2625713937-0
                                                                                                                    • Opcode ID: 5c466567dad973671ce4f1ace6c926c1fcd291e1f5fe7c2ea4ca2b8a1d2235df
                                                                                                                    • Instruction ID: 4d4e7bd30264df152b63cc801fe47a0b3a9c732ba6129534cb4c994d7c468d0f
                                                                                                                    • Opcode Fuzzy Hash: 5c466567dad973671ce4f1ace6c926c1fcd291e1f5fe7c2ea4ca2b8a1d2235df
                                                                                                                    • Instruction Fuzzy Hash: 23F0C931000248EFDB219F65EC1DB953BB5EB103AAF98C315E429451F0DB3D8AA5DF58
                                                                                                                    Function 0073F23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CoInitialize.OLE32(00000000), ref: 0073F2DA
                                                                                                                    • CoCreateInstance.OLE32(0077DA7C,00000000,00000001,0077D8EC,?), ref: 0073F2F2
                                                                                                                    • CoUninitialize.OLE32 ref: 0073F555
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateInitializeInstanceUninitialize
                                                                                                                    • String ID: .lnk
                                                                                                                    • API String ID: 948891078-24824748
                                                                                                                    • Opcode ID: 8898a0ee32d7c11b3dfb766d17b80fcc82cd642c55ef90644ba90ad04c40c885
                                                                                                                    • Instruction ID: 55d399868dbed0a90b4e2d1b6e024cc17e6192be74f6f3df5fe70be2b3534c4e
                                                                                                                    • Opcode Fuzzy Hash: 8898a0ee32d7c11b3dfb766d17b80fcc82cd642c55ef90644ba90ad04c40c885
                                                                                                                    • Instruction Fuzzy Hash: A5A13DB2104205AFD300EF64C886EAFB7EDEF98714F00491DF65597192EB74EA49CB62
                                                                                                                    Function 0073E7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006F53B1,?,?,006F61FF,?,00000000,00000001,00000000), ref: 006F662F
                                                                                                                    • CoInitialize.OLE32(00000000), ref: 0073E85D
                                                                                                                    • CoCreateInstance.OLE32(0077DA7C,00000000,00000001,0077D8EC,?), ref: 0073E876
                                                                                                                    • CoUninitialize.OLE32 ref: 0073E893
                                                                                                                      • Part of subcall function 006F936C: __swprintf.LIBCMT ref: 006F93AB
                                                                                                                      • Part of subcall function 006F936C: __itow.LIBCMT ref: 006F93DF
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                                                                                    • String ID: .lnk
                                                                                                                    • API String ID: 2126378814-24824748
                                                                                                                    • Opcode ID: f77e81f427d1085cd7c1cd1df4c7efce196db5d3a1e02f420cd13ee8ce33dd76
                                                                                                                    • Instruction ID: e3bf5c9b9c625937da5bb3a287cd9bb4429ce24ce5040b5f34db85dc467d2cb3
                                                                                                                    • Opcode Fuzzy Hash: f77e81f427d1085cd7c1cd1df4c7efce196db5d3a1e02f420cd13ee8ce33dd76
                                                                                                                    • Instruction Fuzzy Hash: 4CA147756043059FDB10DF14C484E6ABBE6BF89320F04895CF99A9B3A2CB35ED45CB92
                                                                                                                    Function 0071325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • __startOneArgErrorHandling.LIBCMT ref: 007132ED
                                                                                                                      • Part of subcall function 0071E0D0: __87except.LIBCMT ref: 0071E10B
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorHandling__87except__start
                                                                                                                    • String ID: pow
                                                                                                                    • API String ID: 2905807303-2276729525
                                                                                                                    • Opcode ID: 029596337d31327a9bcf1febed2ff43b6d13ea986a0c0cdf4d6369fd432c452e
                                                                                                                    • Instruction ID: 785d2102ffe2b8019dd5cfb9c0edbb60c1e8a9215ec9df58b02a3b9a3a9ac690
                                                                                                                    • Opcode Fuzzy Hash: 029596337d31327a9bcf1febed2ff43b6d13ea986a0c0cdf4d6369fd432c452e
                                                                                                                    • Instruction Fuzzy Hash: 4C512831A08205E6DB15771CC9553FA6BA4AB40710F348D68FCE5821E9EF3CCEC5A74A
                                                                                                                    Function 00734606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,0078DC50,?,0000000F,0000000C,00000016,0078DC50,?), ref: 00734645
                                                                                                                      • Part of subcall function 006F936C: __swprintf.LIBCMT ref: 006F93AB
                                                                                                                      • Part of subcall function 006F936C: __itow.LIBCMT ref: 006F93DF
                                                                                                                    • CharUpperBuffW.USER32(?,?,00000000,?), ref: 007346C5
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: BuffCharUpper$__itow__swprintf
                                                                                                                    • String ID: REMOVE$THIS
                                                                                                                    • API String ID: 3797816924-776492005
                                                                                                                    • Opcode ID: 61ce20f10acf514a8bb14b3b05bc1dd53294693b3d671748e63e5daae1b6db04
                                                                                                                    • Instruction ID: 6eeea46f8b025514ee94bd96c460f6e21e116440f6a01190e1c4a7b4835b035d
                                                                                                                    • Opcode Fuzzy Hash: 61ce20f10acf514a8bb14b3b05bc1dd53294693b3d671748e63e5daae1b6db04
                                                                                                                    • Instruction Fuzzy Hash: 27418175A00219DFDF04EFA4C885ABDB7B5FF4A304F148069E916AB292DB38ED45CB50
                                                                                                                    Function 0072C189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0073430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0072BC08,?,?,00000034,00000800,?,00000034), ref: 00734335
                                                                                                                    • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0072C1D3
                                                                                                                      • Part of subcall function 007342D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0072BC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00734300
                                                                                                                      • Part of subcall function 0073422F: GetWindowThreadProcessId.USER32(?,?), ref: 0073425A
                                                                                                                      • Part of subcall function 0073422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0072BBCC,00000034,?,?,00001004,00000000,00000000), ref: 0073426A
                                                                                                                      • Part of subcall function 0073422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0072BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00734280
                                                                                                                    • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0072C240
                                                                                                                    • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0072C28D
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                                                                    • String ID: @
                                                                                                                    • API String ID: 4150878124-2766056989
                                                                                                                    • Opcode ID: 14ca307c157e05b6799952c1c801d110d45100b7ffd7e0df7bbbd931a25925af
                                                                                                                    • Instruction ID: bf35461776c66d7ab8c9467a3ef0bd4cc45e01a6a31ce2681092608f56c404e2
                                                                                                                    • Opcode Fuzzy Hash: 14ca307c157e05b6799952c1c801d110d45100b7ffd7e0df7bbbd931a25925af
                                                                                                                    • Instruction Fuzzy Hash: 7641497290022CEFDB15EFA4CC85AEEB7B8BF19300F104099FA55B7181DA756E85CB61
                                                                                                                    Function 0075A63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0078DC00,00000000,?,?,?,?), ref: 0075A6D8
                                                                                                                    • GetWindowLongW.USER32 ref: 0075A6F5
                                                                                                                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0075A705
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$Long
                                                                                                                    • String ID: SysTreeView32
                                                                                                                    • API String ID: 847901565-1698111956
                                                                                                                    • Opcode ID: 1478edb2a410bdbd7a10a96ae6c61bbe950a9b9cc06d9a8b4cb40e987a534c9e
                                                                                                                    • Instruction ID: cf8f15aada4488b7a5825ceee58dd54721cb718a884a29201b1e7ab439854b08
                                                                                                                    • Opcode Fuzzy Hash: 1478edb2a410bdbd7a10a96ae6c61bbe950a9b9cc06d9a8b4cb40e987a534c9e
                                                                                                                    • Instruction Fuzzy Hash: 7231AD3160020ABFDB218E38CC45BEA77A9FF49364F244725F875931E0C7B8AC548B94
                                                                                                                    Function 00745180 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 00745190
                                                                                                                    • InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 007451C6
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CrackInternet_memset
                                                                                                                    • String ID: |$Dt
                                                                                                                    • API String ID: 1413715105-3421994660
                                                                                                                    • Opcode ID: 829a1cc366c7c31ade98e8d9762b0fa110a2bceef1b44ea818e6b911613b27d9
                                                                                                                    • Instruction ID: b26ff033729f8a6542e4205b3e824dc5954975b561fd58646fa2f887af44660f
                                                                                                                    • Opcode Fuzzy Hash: 829a1cc366c7c31ade98e8d9762b0fa110a2bceef1b44ea818e6b911613b27d9
                                                                                                                    • Instruction Fuzzy Hash: 8E313B71C0011DABCF41EFA4CD85AEE7FB9FF14710F000119F915A6166DB75AA46CBA4
                                                                                                                    Function 0075A0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0075A15E
                                                                                                                    • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 0075A172
                                                                                                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 0075A196
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$Window
                                                                                                                    • String ID: SysMonthCal32
                                                                                                                    • API String ID: 2326795674-1439706946
                                                                                                                    • Opcode ID: 67f50315c09664c62dd4fa0551c0f6603ec2147911c763856e1318bd3341b925
                                                                                                                    • Instruction ID: 22b34985f9d08e9aea8b2741ada89030d31f9ebd4dccf6d8ad1065be00e48f43
                                                                                                                    • Opcode Fuzzy Hash: 67f50315c09664c62dd4fa0551c0f6603ec2147911c763856e1318bd3341b925
                                                                                                                    • Instruction Fuzzy Hash: 4421AD32510218BBEF258F94CC46FEA3B79EF48754F110224FE55AB1D0DAB9AC54CBA0
                                                                                                                    Function 0075A88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0075A941
                                                                                                                    • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0075A94F
                                                                                                                    • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0075A956
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$DestroyWindow
                                                                                                                    • String ID: msctls_updown32
                                                                                                                    • API String ID: 4014797782-2298589950
                                                                                                                    • Opcode ID: 15062795654ff1865f66c307db52aa5c33e3abbf2372b9aae79ebf201c1c98d7
                                                                                                                    • Instruction ID: 1bd03ba620baa70a73fd6328019e0d9e09549ced8a8011cd038044094e3ed920
                                                                                                                    • Opcode Fuzzy Hash: 15062795654ff1865f66c307db52aa5c33e3abbf2372b9aae79ebf201c1c98d7
                                                                                                                    • Instruction Fuzzy Hash: AA21B2B5600209BFDB10DF18CC91DB737ADEF4A3A8B450259FA0497251DB78FC158B61
                                                                                                                    Function 007599A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00759A30
                                                                                                                    • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00759A40
                                                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00759A65
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$MoveWindow
                                                                                                                    • String ID: Listbox
                                                                                                                    • API String ID: 3315199576-2633736733
                                                                                                                    • Opcode ID: e34d20902b3ee3052a88b63be7c08370441fdd774e4805b392f35af54545a890
                                                                                                                    • Instruction ID: 6d067a80e05f24c895324eeba9b97918cf49167f321c361cae12d0d6b9d7d11b
                                                                                                                    • Opcode Fuzzy Hash: e34d20902b3ee3052a88b63be7c08370441fdd774e4805b392f35af54545a890
                                                                                                                    • Instruction Fuzzy Hash: 0121A172610118FFDB218F54CC85EFB3BAAEF89751F018129FA4497190C6B9AC55C7A0
                                                                                                                    Function 0075A409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0075A46D
                                                                                                                    • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 0075A482
                                                                                                                    • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 0075A48F
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend
                                                                                                                    • String ID: msctls_trackbar32
                                                                                                                    • API String ID: 3850602802-1010561917
                                                                                                                    • Opcode ID: 74bee83044af2d02c3496a9586dc489c62fe98c082846a0ffc2f6cd76fc874c7
                                                                                                                    • Instruction ID: 3cbc30ee2068e401b43a0c903c66cade7216330d2c9d9aaa4d2dd7460be49ea4
                                                                                                                    • Opcode Fuzzy Hash: 74bee83044af2d02c3496a9586dc489c62fe98c082846a0ffc2f6cd76fc874c7
                                                                                                                    • Instruction Fuzzy Hash: F911E771200248BEEF245FA8CC49FEB37A9EF89754F014228FE45A6091D7BAE815C724
                                                                                                                    Function 00712287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00712350,?), ref: 007122A1
                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 007122A8
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                                    • String ID: RoInitialize$combase.dll
                                                                                                                    • API String ID: 2574300362-340411864
                                                                                                                    • Opcode ID: 53e77528f72aec939178235f429c54990f9574be2747b9ff9638e4c3e6886b00
                                                                                                                    • Instruction ID: fcd8bb7dccf8b7d7de89ec3beb7652fffe25e70c88da3041a0a1776dbe77f285
                                                                                                                    • Opcode Fuzzy Hash: 53e77528f72aec939178235f429c54990f9574be2747b9ff9638e4c3e6886b00
                                                                                                                    • Instruction Fuzzy Hash: F4E01A70690308BBDB605F78EC4AF5A3665BB45786F01C120F106E50E0DBBC4891CF4C
                                                                                                                    Function 0071235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00712276), ref: 00712376
                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0071237D
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                                    • String ID: RoUninitialize$combase.dll
                                                                                                                    • API String ID: 2574300362-2819208100
                                                                                                                    • Opcode ID: a8530c45d4686775376b22fbf90f96f0c619a2e068c35f84e01cf417fec1deab
                                                                                                                    • Instruction ID: b8ba930e520d451069266fae4cf467a2e5a573eb47411fae5b8d9545f2a32850
                                                                                                                    • Opcode Fuzzy Hash: a8530c45d4686775376b22fbf90f96f0c619a2e068c35f84e01cf417fec1deab
                                                                                                                    • Instruction Fuzzy Hash: D2E092B0544308ABDB645B68ED0DF5A3A79BB00742F11C524F10DE20B0EBBC9891CF58
                                                                                                                    Function 0076AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: LocalTime__swprintf
                                                                                                                    • String ID: %.3d$WIN_XPe
                                                                                                                    • API String ID: 2070861257-2409531811
                                                                                                                    • Opcode ID: 7f60f0d189903b9666f85a7988e38b5f739cb0a30bcd1b422b6214d2fc405257
                                                                                                                    • Instruction ID: bf7f19a0397cc05671d7fcb8cbb870b3d1750546c4e869de3d775502429d094c
                                                                                                                    • Opcode Fuzzy Hash: 7f60f0d189903b9666f85a7988e38b5f739cb0a30bcd1b422b6214d2fc405257
                                                                                                                    • Instruction Fuzzy Hash: D2E0ECB1804618EBCB1097908D499F973BCAB04741F540092BD07B1140D63D9B84AE22
                                                                                                                    Function 00752205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,007521FB,?,007523EF), ref: 00752213
                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00752225
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                                    • String ID: GetProcessId$kernel32.dll
                                                                                                                    • API String ID: 2574300362-399901964
                                                                                                                    • Opcode ID: b241c542ad7ea2d5deb13889804d360e013a30992f17349ede4d64dfc1318677
                                                                                                                    • Instruction ID: c1d3931f1f5f0f7b28ed3591cfb325438de86213160804d4323d6b3150d2326f
                                                                                                                    • Opcode Fuzzy Hash: b241c542ad7ea2d5deb13889804d360e013a30992f17349ede4d64dfc1318677
                                                                                                                    • Instruction Fuzzy Hash: D6D05E788007169FC7215B24A80864176E5AF46311F128429AC45A2151D6B9D8C58650
                                                                                                                    Function 006F42F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,00000000,006F42EC,?,006F42AA,?), ref: 006F4304
                                                                                                                    • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006F4316
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                                    • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                                                                    • API String ID: 2574300362-1355242751
                                                                                                                    • Opcode ID: a029fa030858eceac0d04c470cd3d0c04375a1ca09b5ec4642bde5d6684dcd89
                                                                                                                    • Instruction ID: 3bb91dd1e5f6c8cd237bca996258026a08ea168b115dbb019729aab989283baa
                                                                                                                    • Opcode Fuzzy Hash: a029fa030858eceac0d04c470cd3d0c04375a1ca09b5ec4642bde5d6684dcd89
                                                                                                                    • Instruction Fuzzy Hash: 95D0A7718047169FC7304F65E80C65377E5AF45311F01842DE945D2660EBB8CCC0C710
                                                                                                                    Function 006F434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,006F41BB,006F4341,?,006F422F,?,006F41BB,?,?,?,?,006F39FE,?,00000001), ref: 006F4359
                                                                                                                    • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006F436B
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                                    • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                                                                    • API String ID: 2574300362-3689287502
                                                                                                                    • Opcode ID: dc2f916f06ce60ec488ef1659ce5ea934319aeafd31d201d4953d7312e5e450f
                                                                                                                    • Instruction ID: edb63303e4d477073f4a985893e221d2f5bd7c56a9d1c8e6f03a2a1193458ba4
                                                                                                                    • Opcode Fuzzy Hash: dc2f916f06ce60ec488ef1659ce5ea934319aeafd31d201d4953d7312e5e450f
                                                                                                                    • Instruction Fuzzy Hash: 98D0A77140C716DFD7304F35E80865377E5AF11715B02852DE895D2650DBB8DCC0C710
                                                                                                                    Function 00730564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadLibraryA.KERNEL32(oleaut32.dll,00000000,0073052F,?,007306D7), ref: 00730572
                                                                                                                    • GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00730584
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                                    • String ID: UnRegisterTypeLibForUser$oleaut32.dll
                                                                                                                    • API String ID: 2574300362-1587604923
                                                                                                                    • Opcode ID: 6a505c433110d562fa33db20d446ad6dbe75581116864e3a79773928630fb3ac
                                                                                                                    • Instruction ID: 55656e855f77562d0945ac6f987e49e31819ed8c4485fd4c3672bd18f1ecfb2d
                                                                                                                    • Opcode Fuzzy Hash: 6a505c433110d562fa33db20d446ad6dbe75581116864e3a79773928630fb3ac
                                                                                                                    • Instruction Fuzzy Hash: D7D05E715003129ED7205F24A808A0277F4AF05310F51C529E84592151D678C8C08A60
                                                                                                                    Function 00730539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadLibraryA.KERNEL32(oleaut32.dll,?,0073051D,?,007305FE), ref: 00730547
                                                                                                                    • GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00730559
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                                    • String ID: RegisterTypeLibForUser$oleaut32.dll
                                                                                                                    • API String ID: 2574300362-1071820185
                                                                                                                    • Opcode ID: 4ff2586e9c0dafd0c7f7fd2099bfd6dc7f4e0e3051ae4233ee4108fa59976c12
                                                                                                                    • Instruction ID: 634ae0c6b2576a835627dfb0bb2a0a399d47a0b96541dae193cdddefa8ebdf52
                                                                                                                    • Opcode Fuzzy Hash: 4ff2586e9c0dafd0c7f7fd2099bfd6dc7f4e0e3051ae4233ee4108fa59976c12
                                                                                                                    • Instruction Fuzzy Hash: C3D0A7744007169FD7308F24E808A0177F4AF01311F51C42DE44AD2152D67CCCC0CA50
                                                                                                                    Function 0074ECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,0074ECBE,?,0074EBBB), ref: 0074ECD6
                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0074ECE8
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                                    • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                                                    • API String ID: 2574300362-1816364905
                                                                                                                    • Opcode ID: a0470247e49327e57f92d43e4162d329020828c849e7862da0d8831bd6ed5bce
                                                                                                                    • Instruction ID: 51bacd99f04225561b1dd3df83de57df9fd55fbdabc33a4e597d6eb73f55e485
                                                                                                                    • Opcode Fuzzy Hash: a0470247e49327e57f92d43e4162d329020828c849e7862da0d8831bd6ed5bce
                                                                                                                    • Instruction Fuzzy Hash: BDD05E704047239ECB205B64A88860276E4AF45360B018529B84992191DBB8C8C08620
                                                                                                                    Function 0074BADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,00000000,0074BAD3,00000001,0074B6EE,?,0078DC00), ref: 0074BAEB
                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 0074BAFD
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                                    • String ID: GetModuleHandleExW$kernel32.dll
                                                                                                                    • API String ID: 2574300362-199464113
                                                                                                                    • Opcode ID: 90617ebfbc5a88a53fe709d4932940b41dc2cd66a0b9f9aa64a40aba99783c87
                                                                                                                    • Instruction ID: 62bf96cb754696f39bc4a662befdc7bf0541154526750c7d90a7d8888174785e
                                                                                                                    • Opcode Fuzzy Hash: 90617ebfbc5a88a53fe709d4932940b41dc2cd66a0b9f9aa64a40aba99783c87
                                                                                                                    • Instruction Fuzzy Hash: 67D052B08007129ECB305F24A848B2276E8AF41390B01842AA88BA2250EBB8CCC0CA14
                                                                                                                    Function 00753BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadLibraryA.KERNEL32(advapi32.dll,?,00753BD1,?,00753E06), ref: 00753BE9
                                                                                                                    • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00753BFB
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                                    • String ID: RegDeleteKeyExW$advapi32.dll
                                                                                                                    • API String ID: 2574300362-4033151799
                                                                                                                    • Opcode ID: 7af50dc4396f390661a3e2b229a90e206d851a852e69214a817346b531d841b9
                                                                                                                    • Instruction ID: 71ca8a88144c77610d6e53d36406131bb69e321658818d8a7e3cc71893a0c08e
                                                                                                                    • Opcode Fuzzy Hash: 7af50dc4396f390661a3e2b229a90e206d851a852e69214a817346b531d841b9
                                                                                                                    • Instruction Fuzzy Hash: 48D0A7B0400756DFC7305F60EC08647BBF4AF42365B118469E849E21A0D6FCC8C4CE20
                                                                                                                    Function 00729B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID:
                                                                                                                    • String ID:
                                                                                                                    • API String ID:
                                                                                                                    • Opcode ID: 4fa4739587f88cf5737a50127c298e250821ba5154a0f26a150bf54ffdb27b5e
                                                                                                                    • Instruction ID: dadb569c261d9c32614ab512bc603b5d75db7064edcf9ac2b9529b6981f4448f
                                                                                                                    • Opcode Fuzzy Hash: 4fa4739587f88cf5737a50127c298e250821ba5154a0f26a150bf54ffdb27b5e
                                                                                                                    • Instruction Fuzzy Hash: 4AC17F75E00225EFCB14CFA4D884AAEB7B5FF48710F154598EA05EB251D734EE81DBA0
                                                                                                                    Function 0074AA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CoInitialize.OLE32(00000000), ref: 0074AAB4
                                                                                                                    • CoUninitialize.OLE32 ref: 0074AABF
                                                                                                                      • Part of subcall function 00730213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0073027B
                                                                                                                    • VariantInit.OLEAUT32(?), ref: 0074AACA
                                                                                                                    • VariantClear.OLEAUT32(?), ref: 0074AD9D
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 780911581-0
                                                                                                                    • Opcode ID: b341a424268f8af60510d43f7e32067edadb27179bbd54898b5b999d01a31cb1
                                                                                                                    • Instruction ID: a7d132c2166f338250debe3419e1b8623c17f62c1b71711bb8ec65246d09cdad
                                                                                                                    • Opcode Fuzzy Hash: b341a424268f8af60510d43f7e32067edadb27179bbd54898b5b999d01a31cb1
                                                                                                                    • Instruction Fuzzy Hash: EAA14675644701AFDB50EF14C485B2AB7E5BF89310F04844DFA9A9B3A2CB38ED44CB96
                                                                                                                    Function 007291CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Variant$AllocClearCopyInitString
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2808897238-0
                                                                                                                    • Opcode ID: a578ee67b9bb4511b5c81750c09f364f6ca5f254cc655c42b25c4721be84602b
                                                                                                                    • Instruction ID: 644d3111770a20806c68f684c12eda181314a1ce725ab8f31d6a75b346470dad
                                                                                                                    • Opcode Fuzzy Hash: a578ee67b9bb4511b5c81750c09f364f6ca5f254cc655c42b25c4721be84602b
                                                                                                                    • Instruction Fuzzy Hash: 3C519330604316DBDB34EF65E895A2EB3E5EF45314F28881FE746CB2D2EB7898808715
                                                                                                                    Function 0075C4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetWindowRect.USER32(013D8080,?), ref: 0075C544
                                                                                                                    • ScreenToClient.USER32(?,00000002), ref: 0075C574
                                                                                                                    • MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 0075C5DA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$ClientMoveRectScreen
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3880355969-0
                                                                                                                    • Opcode ID: dda7d989bbb131da506d853ea97253de194119afa6a4b5e4dc6756abd8868418
                                                                                                                    • Instruction ID: 7169f187973f43bc328a96eb16167c3754981379d521ed6643823580d78bd561
                                                                                                                    • Opcode Fuzzy Hash: dda7d989bbb131da506d853ea97253de194119afa6a4b5e4dc6756abd8868418
                                                                                                                    • Instruction Fuzzy Hash: F2516E75900208EFCF21DF68C880AEE7BB5EF45761F608259F9159B290E778ED85CB90
                                                                                                                    Function 0072C410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0072C462
                                                                                                                    • __itow.LIBCMT ref: 0072C49C
                                                                                                                      • Part of subcall function 0072C6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0072C753
                                                                                                                    • SendMessageW.USER32(?,0000110A,00000001,?), ref: 0072C505
                                                                                                                    • __itow.LIBCMT ref: 0072C55A
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend$__itow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3379773720-0
                                                                                                                    • Opcode ID: c9ad51dc09206971695104927d61d42625476551a036be3f1b0d8694efe42476
                                                                                                                    • Instruction ID: a613bbac1221418ddf0b5a900153a60895b9432445dc3a0be84cb431839544f2
                                                                                                                    • Opcode Fuzzy Hash: c9ad51dc09206971695104927d61d42625476551a036be3f1b0d8694efe42476
                                                                                                                    • Instruction Fuzzy Hash: 4041F571A0061CABDF22EF54D856BFE7BBAAF58300F000019FA05A7181DB78AE558B95
                                                                                                                    Function 0073390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00733966
                                                                                                                    • SetKeyboardState.USER32(00000080,?,00000001), ref: 00733982
                                                                                                                    • PostMessageW.USER32(00000000,00000102,?,00000001), ref: 007339EF
                                                                                                                    • SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00733A4D
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: KeyboardState$InputMessagePostSend
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 432972143-0
                                                                                                                    • Opcode ID: 473b90a627f92154b6c4bf015ec6672bdcc6fa74610599de937652155eccce78
                                                                                                                    • Instruction ID: 566cd2ccc17daca3fd52d86d5e3abb0b99286d1d0efafafa0b20ed3718e24028
                                                                                                                    • Opcode Fuzzy Hash: 473b90a627f92154b6c4bf015ec6672bdcc6fa74610599de937652155eccce78
                                                                                                                    • Instruction Fuzzy Hash: 99411570A04208EAFF308B64880ABFDBBB59B45315F04415AF4C1962C3C7BCAE85D765
                                                                                                                    Function 0073E698 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0073E742
                                                                                                                    • GetLastError.KERNEL32(?,00000000), ref: 0073E768
                                                                                                                    • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0073E78D
                                                                                                                    • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0073E7B9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3321077145-0
                                                                                                                    • Opcode ID: dde785b442a881ea7f287914d29e989f7a15acd884538d7e13ec5a79bb80f14a
                                                                                                                    • Instruction ID: a7bc19377675830f6e640979aa84eb9f74d84aa2a7475f57082b32d4803f95b4
                                                                                                                    • Opcode Fuzzy Hash: dde785b442a881ea7f287914d29e989f7a15acd884538d7e13ec5a79bb80f14a
                                                                                                                    • Instruction Fuzzy Hash: 2E414C36200614DFDF11EF15C445A5DBBE6BF59710F098488EA46AB3A2CB34FD41CB95
                                                                                                                    Function 0075B544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0075B5D1
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InvalidateRect
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 634782764-0
                                                                                                                    • Opcode ID: f0dbb01305241cc9187ae119e2078ac95e878e8a11bb4e36759c427102eea309
                                                                                                                    • Instruction ID: ea87d2ee776da72b26bf6e647da3a4bc2db740aaaf1ef1903231a314798b28c5
                                                                                                                    • Opcode Fuzzy Hash: f0dbb01305241cc9187ae119e2078ac95e878e8a11bb4e36759c427102eea309
                                                                                                                    • Instruction Fuzzy Hash: 1631D074600208BFEB389F18CC89FF87765EB05352FA48101FE11D61E1D7BCA9988B95
                                                                                                                    Function 0075D7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • ClientToScreen.USER32(?,?), ref: 0075D807
                                                                                                                    • GetWindowRect.USER32(?,?), ref: 0075D87D
                                                                                                                    • PtInRect.USER32(?,?,0075ED5A), ref: 0075D88D
                                                                                                                    • MessageBeep.USER32(00000000), ref: 0075D8FE
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1352109105-0
                                                                                                                    • Opcode ID: c8c875144c63f11e2fc2f5957229f8139c30691c4406e6815434cc75bc702fdc
                                                                                                                    • Instruction ID: 1bab2c10fb3e8d5db2bfd815c729ae121de2bee8215d35dbf8a98a702110b249
                                                                                                                    • Opcode Fuzzy Hash: c8c875144c63f11e2fc2f5957229f8139c30691c4406e6815434cc75bc702fdc
                                                                                                                    • Instruction Fuzzy Hash: 27416774A00219DFCB31DF58D888BA97BB5FB48356F5881A9E8149B260D7B8BD49CB40
                                                                                                                    Function 00733A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00733AB8
                                                                                                                    • SetKeyboardState.USER32(00000080,?,00008000), ref: 00733AD4
                                                                                                                    • PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00733B34
                                                                                                                    • SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00733B92
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: KeyboardState$InputMessagePostSend
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 432972143-0
                                                                                                                    • Opcode ID: 1d39d05cb8ccaefecce928e6ae93fa3b8398bce0eeb509c0685339e66ffd2594
                                                                                                                    • Instruction ID: b04c6eeeca834158733b2e36aa650324c9d7121f3124329bf9a611105d7fbacc
                                                                                                                    • Opcode Fuzzy Hash: 1d39d05cb8ccaefecce928e6ae93fa3b8398bce0eeb509c0685339e66ffd2594
                                                                                                                    • Instruction Fuzzy Hash: 7B3103B0A00258AEFF308B648819BFEBBB99B55321F04415AF485972D3C77D8F85C766
                                                                                                                    Function 00724004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00724038
                                                                                                                    • __isleadbyte_l.LIBCMT ref: 00724066
                                                                                                                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00724094
                                                                                                                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 007240CA
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3058430110-0
                                                                                                                    • Opcode ID: 73441e0e7616522ad26de3777d24c7da1c245603c8e49f255911abf6029f9373
                                                                                                                    • Instruction ID: 90588c3ff327ea44b19bc4d09d4b16908d99b6705b2e375e4c5b46f55c4d698a
                                                                                                                    • Opcode Fuzzy Hash: 73441e0e7616522ad26de3777d24c7da1c245603c8e49f255911abf6029f9373
                                                                                                                    • Instruction Fuzzy Hash: 8331CE3160026AEFDB31DF74D844BAA7BB5BF40350F1580A8EA658B0A0E739DCD0DB90
                                                                                                                    Function 00757CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetForegroundWindow.USER32 ref: 00757CB9
                                                                                                                      • Part of subcall function 00735F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 00735F6F
                                                                                                                      • Part of subcall function 00735F55: GetCurrentThreadId.KERNEL32 ref: 00735F76
                                                                                                                      • Part of subcall function 00735F55: AttachThreadInput.USER32(00000000,?,0073781F), ref: 00735F7D
                                                                                                                    • GetCaretPos.USER32(?), ref: 00757CCA
                                                                                                                    • ClientToScreen.USER32(00000000,?), ref: 00757D03
                                                                                                                    • GetForegroundWindow.USER32 ref: 00757D09
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2759813231-0
                                                                                                                    • Opcode ID: a6de184ca2053cd213500c5ee90bbcf2ea2eb2d43ff6a8e21c1b1e3baf4c463a
                                                                                                                    • Instruction ID: 13fb7d6165b63fa69b83391a0fe014592af5f2de27b04cc5d1a7fa372838ce59
                                                                                                                    • Opcode Fuzzy Hash: a6de184ca2053cd213500c5ee90bbcf2ea2eb2d43ff6a8e21c1b1e3baf4c463a
                                                                                                                    • Instruction Fuzzy Hash: 8F313E72900108EFDB10EFA5D8499EFBBF9EF58310B108466E815E3212DA359E05CBA0
                                                                                                                    Function 0075F1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070B34E: GetWindowLongW.USER32(?,000000EB), ref: 0070B35F
                                                                                                                    • GetCursorPos.USER32(?), ref: 0075F211
                                                                                                                    • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0076E4C0,?,?,?,?,?), ref: 0075F226
                                                                                                                    • GetCursorPos.USER32(?), ref: 0075F270
                                                                                                                    • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0076E4C0,?,?,?), ref: 0075F2A6
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2864067406-0
                                                                                                                    • Opcode ID: 9a7110697e9fad476c9e087e71ca0d20f485b3723f495915ebde55a8a6c48105
                                                                                                                    • Instruction ID: c53bd0cbbf56cbb481405d6bb9473ce97f7201002dade82134b80a781a2fcd4c
                                                                                                                    • Opcode Fuzzy Hash: 9a7110697e9fad476c9e087e71ca0d20f485b3723f495915ebde55a8a6c48105
                                                                                                                    • Instruction Fuzzy Hash: 9E21DD79600018EFCB258F94CC58EEE7BB9FF49351F448069F9098B2A1D7789DA0DB90
                                                                                                                    Function 0074431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00744358
                                                                                                                      • Part of subcall function 007443E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00744401
                                                                                                                      • Part of subcall function 007443E2: InternetCloseHandle.WININET(00000000), ref: 0074449E
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Internet$CloseConnectHandleOpen
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1463438336-0
                                                                                                                    • Opcode ID: 3b0aabccf0f346d061d55751f563092e4194fc448bfc0d241e69c29ad608fffb
                                                                                                                    • Instruction ID: f4e08174e0626dd1c4b5134a3e10bc51865c67c332d839f88607de8c583a3b3a
                                                                                                                    • Opcode Fuzzy Hash: 3b0aabccf0f346d061d55751f563092e4194fc448bfc0d241e69c29ad608fffb
                                                                                                                    • Instruction Fuzzy Hash: DD21C376200B05BFEB259F60DC01FBBB7B9FF44B10F10401AFA15A7650DB799861A794
                                                                                                                    Function 00748A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00748AE0
                                                                                                                    • __WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00748AF2
                                                                                                                    • accept.WSOCK32(00000000,00000000,00000000), ref: 00748AFF
                                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00748B16
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ErrorLastacceptselect
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 385091864-0
                                                                                                                    • Opcode ID: 35242c71154275628edd51c22a056bbe22c41b6dfe709be08f9e7ee9165fbbec
                                                                                                                    • Instruction ID: f52391c69ca6cb77f86e40c03020f85fbe48a1855007d94e6ebc49c7a87cae27
                                                                                                                    • Opcode Fuzzy Hash: 35242c71154275628edd51c22a056bbe22c41b6dfe709be08f9e7ee9165fbbec
                                                                                                                    • Instruction Fuzzy Hash: B5219672A001249FC7259F68C889A9E7BFCEF49350F00816AF849D7291DB789E81CFD4
                                                                                                                    Function 00758A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetWindowLongW.USER32(?,000000EC), ref: 00758AA6
                                                                                                                    • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00758AC0
                                                                                                                    • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00758ACE
                                                                                                                    • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00758ADC
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$Long$AttributesLayered
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2169480361-0
                                                                                                                    • Opcode ID: a8d0304be1abe1012f67e8fa17a6c75e738c01a7354b14fae9bd67de55f33088
                                                                                                                    • Instruction ID: b4eaf0011dab980b8da03b158c307a2206a21c5c455f66ea2522e12ce86db7ba
                                                                                                                    • Opcode Fuzzy Hash: a8d0304be1abe1012f67e8fa17a6c75e738c01a7354b14fae9bd67de55f33088
                                                                                                                    • Instruction Fuzzy Hash: 93110631205015AFE7549B14CC09FBA77A9BF85321F18810AFD16D72E2CBB8AD008B95
                                                                                                                    Function 00730AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00731E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00730ABB,?,?,?,0073187A,00000000,000000EF,00000119,?,?), ref: 00731E77
                                                                                                                      • Part of subcall function 00731E68: lstrcpyW.KERNEL32(00000000,?,?,00730ABB,?,?,?,0073187A,00000000,000000EF,00000119,?,?,00000000), ref: 00731E9D
                                                                                                                      • Part of subcall function 00731E68: lstrcmpiW.KERNEL32(00000000,?,00730ABB,?,?,?,0073187A,00000000,000000EF,00000119,?,?), ref: 00731ECE
                                                                                                                    • lstrlenW.KERNEL32(?,00000002,?,?,?,?,0073187A,00000000,000000EF,00000119,?,?,00000000), ref: 00730AD4
                                                                                                                    • lstrcpyW.KERNEL32(00000000,?,?,0073187A,00000000,000000EF,00000119,?,?,00000000), ref: 00730AFA
                                                                                                                    • lstrcmpiW.KERNEL32(00000002,cdecl,?,0073187A,00000000,000000EF,00000119,?,?,00000000), ref: 00730B2E
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: lstrcmpilstrcpylstrlen
                                                                                                                    • String ID: cdecl
                                                                                                                    • API String ID: 4031866154-3896280584
                                                                                                                    • Opcode ID: c17c1dd5cebe4f1f0b695de41d35f1508195213df8d27358b6c119df10311aff
                                                                                                                    • Instruction ID: eb119015a895a51a294366a1cb54f6210e38347438c498558b36a98adeebc141
                                                                                                                    • Opcode Fuzzy Hash: c17c1dd5cebe4f1f0b695de41d35f1508195213df8d27358b6c119df10311aff
                                                                                                                    • Instruction Fuzzy Hash: 8D11A276100305EFEB259F24DC15D7A77A8FF45354F80416AE805CB291EB759851C7E0
                                                                                                                    Function 00722F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _free.LIBCMT ref: 00722FB5
                                                                                                                      • Part of subcall function 0071395C: __FF_MSGBANNER.LIBCMT ref: 00713973
                                                                                                                      • Part of subcall function 0071395C: __NMSG_WRITE.LIBCMT ref: 0071397A
                                                                                                                      • Part of subcall function 0071395C: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,00000000,?,?,0070F507,?,0000000E), ref: 0071399F
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: AllocateHeap_free
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 614378929-0
                                                                                                                    • Opcode ID: be1dc9145362ebd31bbb45013439ef8699fa41798b5e362e8b324d15fa3a126c
                                                                                                                    • Instruction ID: 8ad0cfe0174499b7b0c88a18c1d626dbf18bd97e61416ea776e036e3bcf35a37
                                                                                                                    • Opcode Fuzzy Hash: be1dc9145362ebd31bbb45013439ef8699fa41798b5e362e8b324d15fa3a126c
                                                                                                                    • Instruction Fuzzy Hash: C311AB31509221EBDB353F74BC0969A3BB8AF543A0F208915F9499E191DA3CCD80DAE4
                                                                                                                    Function 0073058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 007305AC
                                                                                                                    • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 007305C7
                                                                                                                    • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 007305DD
                                                                                                                    • FreeLibrary.KERNEL32(?), ref: 00730632
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Type$FileFreeLibraryLoadModuleNameRegister
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3137044355-0
                                                                                                                    • Opcode ID: 481f0c9edd312eaaa9bbb7a6da3b7df91d9e003028fb4defbb8c10d173d4133f
                                                                                                                    • Instruction ID: 6d677f136310df29e67dd245bf8a4f37e3e48c0eaebaade61738dc0fd3213c88
                                                                                                                    • Opcode Fuzzy Hash: 481f0c9edd312eaaa9bbb7a6da3b7df91d9e003028fb4defbb8c10d173d4133f
                                                                                                                    • Instruction Fuzzy Hash: AF219371900219EFEB20CF91DCAAADABBBCEF80740F00846DE51A92151D778EA55DF91
                                                                                                                    Function 00736713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00736733
                                                                                                                    • _memset.LIBCMT ref: 00736754
                                                                                                                    • DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 007367A6
                                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 007367AF
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CloseControlCreateDeviceFileHandle_memset
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1157408455-0
                                                                                                                    • Opcode ID: 77bbd63ad94e6f7bbb41b0d9c4e01dbb146f9402c6f51aa709d66e7bdb7da9b5
                                                                                                                    • Instruction ID: 49189d41492ff6d1f2e9e74b65f0998daec960dc16e05e7d915d5d43a4dcee96
                                                                                                                    • Opcode Fuzzy Hash: 77bbd63ad94e6f7bbb41b0d9c4e01dbb146f9402c6f51aa709d66e7bdb7da9b5
                                                                                                                    • Instruction Fuzzy Hash: AA11CA75901228BAE73057A5AC4DFEBBABCEF44764F10819AF508E71D1D2744E808BA8
                                                                                                                    Function 0072B1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0072AA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 0072AA79
                                                                                                                      • Part of subcall function 0072AA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 0072AA83
                                                                                                                      • Part of subcall function 0072AA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 0072AA92
                                                                                                                      • Part of subcall function 0072AA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 0072AA99
                                                                                                                      • Part of subcall function 0072AA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0072AAAF
                                                                                                                    • GetLengthSid.ADVAPI32(?,00000000,0072ADE4,?,?), ref: 0072B21B
                                                                                                                    • GetProcessHeap.KERNEL32(00000008,00000000), ref: 0072B227
                                                                                                                    • HeapAlloc.KERNEL32(00000000), ref: 0072B22E
                                                                                                                    • CopySid.ADVAPI32(?,00000000,?), ref: 0072B247
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4217664535-0
                                                                                                                    • Opcode ID: 44333bb8f59518d67c7be8722cc81b69a344d7059249be542a532190e86b1dce
                                                                                                                    • Instruction ID: 2fca94d7f5b40b38366cbf1b743d84bc3cf865599ed23ee90f42e919a5980845
                                                                                                                    • Opcode Fuzzy Hash: 44333bb8f59518d67c7be8722cc81b69a344d7059249be542a532190e86b1dce
                                                                                                                    • Instruction Fuzzy Hash: 3211BC71A00215FFCB189F98ED84AAEB7F9FF84308B14802DE94697211D739AE84CB10
                                                                                                                    Function 0072B478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0072B498
                                                                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 0072B4AA
                                                                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 0072B4C0
                                                                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 0072B4DB
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3850602802-0
                                                                                                                    • Opcode ID: 003a723ec7185fb73f041bcfec16c8e3914423e2a4223183edb6755ef80eb603
                                                                                                                    • Instruction ID: dccbac980172bf9e5748e83932b0510f5e2406b789c02e5f048a4fe4f5b2418d
                                                                                                                    • Opcode Fuzzy Hash: 003a723ec7185fb73f041bcfec16c8e3914423e2a4223183edb6755ef80eb603
                                                                                                                    • Instruction Fuzzy Hash: 1C11487A900228FFDB11EFA8C885E9DBBB4FB08750F204091E604B7290D771AE10DB94
                                                                                                                    Function 0070B55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070B34E: GetWindowLongW.USER32(?,000000EB), ref: 0070B35F
                                                                                                                    • DefDlgProcW.USER32(?,00000020,?,00000000), ref: 0070B5A5
                                                                                                                    • GetClientRect.USER32(?,?), ref: 0076E69A
                                                                                                                    • GetCursorPos.USER32(?), ref: 0076E6A4
                                                                                                                    • ScreenToClient.USER32(?,?), ref: 0076E6AF
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Client$CursorLongProcRectScreenWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 4127811313-0
                                                                                                                    • Opcode ID: cf7c535a6946a680f350738d4eeb3d0157adcb3adfc0d3c545753f33565c47ad
                                                                                                                    • Instruction ID: 12bb17552901149865246dfd6ae30e5de86f651fe165fdc010f70a4e757c1a74
                                                                                                                    • Opcode Fuzzy Hash: cf7c535a6946a680f350738d4eeb3d0157adcb3adfc0d3c545753f33565c47ad
                                                                                                                    • Instruction Fuzzy Hash: F811363590002AFBCB20DFA4CC499EE7BB8EF08305F504591E902E7180D738AEA1CBB5
                                                                                                                    Function 0073732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00737352
                                                                                                                    • MessageBoxW.USER32(?,?,?,?), ref: 00737385
                                                                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0073739B
                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 007373A2
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2880819207-0
                                                                                                                    • Opcode ID: c3829b18a7cc0ec74a177bce0a3c569e3365da50eae538c046723065a5390107
                                                                                                                    • Instruction ID: fbfe26bb971bd7270bc7631cd6b42f3ad13ca0d7d78666b1cb499c646062468f
                                                                                                                    • Opcode Fuzzy Hash: c3829b18a7cc0ec74a177bce0a3c569e3365da50eae538c046723065a5390107
                                                                                                                    • Instruction Fuzzy Hash: F31108B2A04244BFD7159B6CDC09FDE7BADAF45350F048315F825D32A2D6788D4097A4
                                                                                                                    Function 0070D17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0070D1BA
                                                                                                                    • GetStockObject.GDI32(00000011), ref: 0070D1CE
                                                                                                                    • SendMessageW.USER32(00000000,00000030,00000000), ref: 0070D1D8
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CreateMessageObjectSendStockWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3970641297-0
                                                                                                                    • Opcode ID: 0411494cedba611fd53f8f6b7d07112d8c28ee9d8a03f99acfe60b91c9ba6cea
                                                                                                                    • Instruction ID: 0aaba49dae4572a8ee655dd51fbe1d0280733399879b8a8841dac6026ec9ec39
                                                                                                                    • Opcode Fuzzy Hash: 0411494cedba611fd53f8f6b7d07112d8c28ee9d8a03f99acfe60b91c9ba6cea
                                                                                                                    • Instruction Fuzzy Hash: 7D11A17210160DFFEB254F909C54EEABBA9FF083A8F054201FA1552090CB399C60DBA0
                                                                                                                    Function 00724DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3016257755-0
                                                                                                                    • Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                                                                                    • Instruction ID: 2e7a2f029caf024bfe20a9cc990b3c9d7888f6503b340bb95a69fd65852b3859
                                                                                                                    • Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                                                                                    • Instruction Fuzzy Hash: 9501483284015AFBDF125E94EC058EE3F23BB18354B5A8455FA2859035D33ACAB2AB81
                                                                                                                    Function 00717452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 00717A0D: __getptd_noexit.LIBCMT ref: 00717A0E
                                                                                                                    • __lock.LIBCMT ref: 0071748F
                                                                                                                    • InterlockedDecrement.KERNEL32(?), ref: 007174AC
                                                                                                                    • _free.LIBCMT ref: 007174BF
                                                                                                                    • InterlockedIncrement.KERNEL32(013C0D80), ref: 007174D7
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2704283638-0
                                                                                                                    • Opcode ID: 0d3afea977f8c644c24b5b47a1d11bc8f59800e3d6a72f8cc5d5e4701f19ca12
                                                                                                                    • Instruction ID: 70c6bcd2f63cf7e317c25b907fd1b5f29dfba68fdf9156c309eca0a7300c4a88
                                                                                                                    • Opcode Fuzzy Hash: 0d3afea977f8c644c24b5b47a1d11bc8f59800e3d6a72f8cc5d5e4701f19ca12
                                                                                                                    • Instruction Fuzzy Hash: D9016131909651E7DB6AAFAC940A7DDBB70BF45710F248105F814676D0CB2C59C1CFD6
                                                                                                                    Function 0075EA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0070AFE3
                                                                                                                      • Part of subcall function 0070AF83: SelectObject.GDI32(?,00000000), ref: 0070AFF2
                                                                                                                      • Part of subcall function 0070AF83: BeginPath.GDI32(?), ref: 0070B009
                                                                                                                      • Part of subcall function 0070AF83: SelectObject.GDI32(?,00000000), ref: 0070B033
                                                                                                                    • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0075EA8E
                                                                                                                    • LineTo.GDI32(00000000,?,?), ref: 0075EA9B
                                                                                                                    • EndPath.GDI32(00000000), ref: 0075EAAB
                                                                                                                    • StrokePath.GDI32(00000000), ref: 0075EAB9
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1539411459-0
                                                                                                                    • Opcode ID: 40ec1a64222bb2d074c9dacda07f81c1768f372519d98adc97564599c59db23b
                                                                                                                    • Instruction ID: 1b833f978d79400f0873f4d42a747aade5deaf6abf40706808f1573b6b24ad24
                                                                                                                    • Opcode Fuzzy Hash: 40ec1a64222bb2d074c9dacda07f81c1768f372519d98adc97564599c59db23b
                                                                                                                    • Instruction Fuzzy Hash: 16F08932005259B7DB225F64AC0DFCE3F696F05351F44C201FE15650E187BD9A95CB9D
                                                                                                                    Function 0072C82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0072C84A
                                                                                                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0072C85D
                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 0072C864
                                                                                                                    • AttachThreadInput.USER32(00000000), ref: 0072C86B
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2710830443-0
                                                                                                                    • Opcode ID: 04beba4ac5e964a899db241f09d52cb4e44bcacdcf776156d5aa92155fbe56ae
                                                                                                                    • Instruction ID: 906efa74d28066b1b5c9df56a647c30dddef634a7ee6a4915f8fdb6340cc6d30
                                                                                                                    • Opcode Fuzzy Hash: 04beba4ac5e964a899db241f09d52cb4e44bcacdcf776156d5aa92155fbe56ae
                                                                                                                    • Instruction Fuzzy Hash: E9E03971141228BADB211BA2AC0DEDB7F2CEF167E1F40C021B60DC4460C6B989C0CBE0
                                                                                                                    Function 0072B0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetCurrentThread.KERNEL32 ref: 0072B0D6
                                                                                                                    • OpenThreadToken.ADVAPI32(00000000,?,?,?,0072AC9D), ref: 0072B0DD
                                                                                                                    • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0072AC9D), ref: 0072B0EA
                                                                                                                    • OpenProcessToken.ADVAPI32(00000000,?,?,?,0072AC9D), ref: 0072B0F1
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CurrentOpenProcessThreadToken
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 3974789173-0
                                                                                                                    • Opcode ID: 8eba16d02520148bcbe59ecca20019ae9f06329c1b58e2e97dbc15e3adf426a7
                                                                                                                    • Instruction ID: baaffa6b23bac5e3e3946d0f08c3e7f2d647b6097c6a6f33740ccea9b61218b9
                                                                                                                    • Opcode Fuzzy Hash: 8eba16d02520148bcbe59ecca20019ae9f06329c1b58e2e97dbc15e3adf426a7
                                                                                                                    • Instruction Fuzzy Hash: B5E04F326012219BD7301FB16D0CB873BB8AF557D1F01C818A245D6040DA6C9881C764
                                                                                                                    Function 0070B47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetSysColor.USER32(00000008), ref: 0070B496
                                                                                                                    • SetTextColor.GDI32(?,000000FF), ref: 0070B4A0
                                                                                                                    • SetBkMode.GDI32(?,00000001), ref: 0070B4B5
                                                                                                                    • GetStockObject.GDI32(00000005), ref: 0070B4BD
                                                                                                                    • GetWindowDC.USER32(?,00000000), ref: 0076DE2B
                                                                                                                    • GetPixel.GDI32(00000000,00000000,00000000), ref: 0076DE38
                                                                                                                    • GetPixel.GDI32(00000000,?,00000000), ref: 0076DE51
                                                                                                                    • GetPixel.GDI32(00000000,00000000,?), ref: 0076DE6A
                                                                                                                    • GetPixel.GDI32(00000000,?,?), ref: 0076DE8A
                                                                                                                    • ReleaseDC.USER32(?,00000000), ref: 0076DE95
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 1946975507-0
                                                                                                                    • Opcode ID: b1783079ed0daf7c77e69be6ac18aee06a7079096dc6b7e76fe95d827f8a3992
                                                                                                                    • Instruction ID: 112fcf5e70a50a569908f6e810edc1f5fa77a177000be03bc222f702a7ce1543
                                                                                                                    • Opcode Fuzzy Hash: b1783079ed0daf7c77e69be6ac18aee06a7079096dc6b7e76fe95d827f8a3992
                                                                                                                    • Instruction Fuzzy Hash: E0E06D31600244ABDB312B74AC0DBD83B21AF51379F04C726FA7A580E1D37A4E80CB11
                                                                                                                    Function 0072B2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0072B2DF
                                                                                                                    • UnloadUserProfile.USERENV(?,?), ref: 0072B2EB
                                                                                                                    • CloseHandle.KERNEL32(?), ref: 0072B2F4
                                                                                                                    • CloseHandle.KERNEL32(?), ref: 0072B2FC
                                                                                                                      • Part of subcall function 0072AB24: GetProcessHeap.KERNEL32(00000000,?,0072A848), ref: 0072AB2B
                                                                                                                      • Part of subcall function 0072AB24: HeapFree.KERNEL32(00000000), ref: 0072AB32
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 146765662-0
                                                                                                                    • Opcode ID: d499661d8d9cf6b4373295dbd42184d76abb9f83a15dc599dd4ddf86b0a87a9b
                                                                                                                    • Instruction ID: 523fa87fe2dc2bbb75829f946a400d1f0acc9ebc8f92eea8d240c40b1ca93b79
                                                                                                                    • Opcode Fuzzy Hash: d499661d8d9cf6b4373295dbd42184d76abb9f83a15dc599dd4ddf86b0a87a9b
                                                                                                                    • Instruction Fuzzy Hash: 04E0B63A104005FBCB112BA5EC08859FBB6FF88361710C221F62981571CB3AACB1EB95
                                                                                                                    Function 0076B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2889604237-0
                                                                                                                    • Opcode ID: c728ee16c9d751b92ef52f63a3ef2d019f3e70ae9075ce0f8a5f7be7433188e8
                                                                                                                    • Instruction ID: 0b74c5d977318c9c27c3ea9c702c45ccbc91faa41c74380418d4c307b7bbbebf
                                                                                                                    • Opcode Fuzzy Hash: c728ee16c9d751b92ef52f63a3ef2d019f3e70ae9075ce0f8a5f7be7433188e8
                                                                                                                    • Instruction Fuzzy Hash: 0BE0E5B1100204EFDB105F608848A2A7BB9EF48390F11C905A85EC7251DA7898818B54
                                                                                                                    Function 0076B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                    • String ID:
                                                                                                                    • API String ID: 2889604237-0
                                                                                                                    • Opcode ID: b836761d41a5a635531f4c6a0fd3e4124e01f074c47fb316ce12ff958bae7e33
                                                                                                                    • Instruction ID: 2ec33662b9deb2e3ae93d602f48c55aafa56856d77d030d825a79995761cbd04
                                                                                                                    • Opcode Fuzzy Hash: b836761d41a5a635531f4c6a0fd3e4124e01f074c47fb316ce12ff958bae7e33
                                                                                                                    • Instruction Fuzzy Hash: 5FE0EEB1500200EFDB205F608848A29BBA9EF48390B11C909A95E8B251DA79A8818B58
                                                                                                                    Function 0072DCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • OleSetContainedObject.OLE32(?,00000001), ref: 0072DEAA
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ContainedObject
                                                                                                                    • String ID: AutoIt3GUI$Container
                                                                                                                    • API String ID: 3565006973-3941886329
                                                                                                                    • Opcode ID: 36eb881be1aa90f0f6019c9f3e4dae7c2d9bfc842a5b77e58c03927189083ece
                                                                                                                    • Instruction ID: 116dfffca7eeec91e5d9c811ee29de98ceb7ff0292bbf822e973132716aa50ec
                                                                                                                    • Opcode Fuzzy Hash: 36eb881be1aa90f0f6019c9f3e4dae7c2d9bfc842a5b77e58c03927189083ece
                                                                                                                    • Instruction Fuzzy Hash: 5D913570600611EFDB24CF64D888B6AB7F9BF49710F10856AF95ACB691DB78EC41CB60
                                                                                                                    Function 0073290D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _wcscpy
                                                                                                                    • String ID: I/v$I/v
                                                                                                                    • API String ID: 3048848545-938880794
                                                                                                                    • Opcode ID: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
                                                                                                                    • Instruction ID: a29853322cdfad7976b2ec7f4e36e1119578f66567ef4086ffefa388433c59c2
                                                                                                                    • Opcode Fuzzy Hash: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
                                                                                                                    • Instruction Fuzzy Hash: 5341F73590421AABEF25EF98C441AFCB771EF08310F50905AE981B7193DB386E83C7A4
                                                                                                                    Function 0070BCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • Sleep.KERNEL32(00000000), ref: 0070BCDA
                                                                                                                    • GlobalMemoryStatusEx.KERNEL32 ref: 0070BCF3
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: GlobalMemorySleepStatus
                                                                                                                    • String ID: @
                                                                                                                    • API String ID: 2783356886-2766056989
                                                                                                                    • Opcode ID: ce57eba55d303e2c897be19dabb0e927c536a78821e028fdb9e7e40c6c88f7d7
                                                                                                                    • Instruction ID: 74374b5c16aeee858426e4269d353db653401e714035e5065a62a16bb005f181
                                                                                                                    • Opcode Fuzzy Hash: ce57eba55d303e2c897be19dabb0e927c536a78821e028fdb9e7e40c6c88f7d7
                                                                                                                    • Instruction Fuzzy Hash: B4515772408744EBE320AF14DC8ABAFBBE8FF95354F41484DF1C8410A2DB7595AE8766
                                                                                                                    Function 0073C56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 006F44ED: __fread_nolock.LIBCMT ref: 006F450B
                                                                                                                    • _wcscmp.LIBCMT ref: 0073C65D
                                                                                                                    • _wcscmp.LIBCMT ref: 0073C670
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: _wcscmp$__fread_nolock
                                                                                                                    • String ID: FILE
                                                                                                                    • API String ID: 4029003684-3121273764
                                                                                                                    • Opcode ID: 0f95abc76475792b48dfa131347849a45ed804401379a7d5f6982a093f9f1ac0
                                                                                                                    • Instruction ID: 10ba957be48e20ba85aee3c4d98c01fdeed22166f7a81136f3bbf7c3f6e197ad
                                                                                                                    • Opcode Fuzzy Hash: 0f95abc76475792b48dfa131347849a45ed804401379a7d5f6982a093f9f1ac0
                                                                                                                    • Instruction Fuzzy Hash: 1C41D872A0020ABADF119BA4DC86FEF77BADF49714F004069F605FB182DA759A048B55
                                                                                                                    Function 0075A76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,00001132,00000000,?), ref: 0075A85A
                                                                                                                    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0075A86F
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend
                                                                                                                    • String ID: '
                                                                                                                    • API String ID: 3850602802-1997036262
                                                                                                                    • Opcode ID: 70a53ee34b612b1fd38a1e7b762b260ef21c4620911ec06ad11613d4fe62b9c1
                                                                                                                    • Instruction ID: 9766588e93d77697ccfa5b4cf28ab6989ff60aa9cde7082d65f1af74af049991
                                                                                                                    • Opcode Fuzzy Hash: 70a53ee34b612b1fd38a1e7b762b260ef21c4620911ec06ad11613d4fe62b9c1
                                                                                                                    • Instruction Fuzzy Hash: 3441F574E00209AFDB54CF68C880BEA7BB9FB08315F14057AED05AB341D7B5A946CFA1
                                                                                                                    Function 0075975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • DestroyWindow.USER32(?,?,?,?), ref: 0075980E
                                                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0075984A
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$DestroyMove
                                                                                                                    • String ID: static
                                                                                                                    • API String ID: 2139405536-2160076837
                                                                                                                    • Opcode ID: 424ab9afdf8a378eecb5ed1b60887156b7a57701f82b2032b0841bfbe8e6a8d7
                                                                                                                    • Instruction ID: b65f643bbca3f30e08c61f225d4e9952cfcc79b5afd9c683a4d4989c5a61fbb3
                                                                                                                    • Opcode Fuzzy Hash: 424ab9afdf8a378eecb5ed1b60887156b7a57701f82b2032b0841bfbe8e6a8d7
                                                                                                                    • Instruction Fuzzy Hash: 6A319E71110604EAEB109F74CC80BFB73B9FF59761F008619F9A9C7190CA79AC85D760
                                                                                                                    Function 00735157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 007351C6
                                                                                                                    • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00735201
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InfoItemMenu_memset
                                                                                                                    • String ID: 0
                                                                                                                    • API String ID: 2223754486-4108050209
                                                                                                                    • Opcode ID: 14c574601780ad95660ef01e4daa48b2e8ff6982b3ad83e9a663da2697904306
                                                                                                                    • Instruction ID: a4bc2a980ccfd1135085c220cc200b3f5248089dad51ce64044046e7219137a6
                                                                                                                    • Opcode Fuzzy Hash: 14c574601780ad95660ef01e4daa48b2e8ff6982b3ad83e9a663da2697904306
                                                                                                                    • Instruction Fuzzy Hash: F331D6B1600704DBFB24CF99D849BAFBBF4FF45350F144429E985A71A2D7789A44CB50
                                                                                                                    Function 0074658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __snwprintf
                                                                                                                    • String ID: , $$AUTOITCALLVARIABLE%d
                                                                                                                    • API String ID: 2391506597-2584243854
                                                                                                                    • Opcode ID: 48d8139762f50bc6c70dd9e8cd99cfba43bf5971f3a4a992e5a30baa7297c7da
                                                                                                                    • Instruction ID: f85a61921b683ba78e15d9842a7ab1c25c9e7115963d1f3b473e357fa7917359
                                                                                                                    • Opcode Fuzzy Hash: 48d8139762f50bc6c70dd9e8cd99cfba43bf5971f3a4a992e5a30baa7297c7da
                                                                                                                    • Instruction Fuzzy Hash: 89215171600118EFCF14EF64C882EAD77B5BF46740F014469F605AB181DB78EE45CBAA
                                                                                                                    Function 007593CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0075945C
                                                                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00759467
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend
                                                                                                                    • String ID: Combobox
                                                                                                                    • API String ID: 3850602802-2096851135
                                                                                                                    • Opcode ID: 436f1da95335c6dc3b33a0da48271e683f7647a894e06f0fb72693b4626fff50
                                                                                                                    • Instruction ID: bf1686280ee2f36b5163267ccdccbb612ea98a068b728df18ab2cd8e758fbfd6
                                                                                                                    • Opcode Fuzzy Hash: 436f1da95335c6dc3b33a0da48271e683f7647a894e06f0fb72693b4626fff50
                                                                                                                    • Instruction Fuzzy Hash: C01193B1200248EFEF219F54DC80EFB376EEB883A5F104125FE1897290D6B99C568760
                                                                                                                    Function 0075DA42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070B34E: GetWindowLongW.USER32(?,000000EB), ref: 0070B35F
                                                                                                                    • GetActiveWindow.USER32 ref: 0075DA7B
                                                                                                                    • EnumChildWindows.USER32(?,0075D75F,00000000), ref: 0075DAF5
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$ActiveChildEnumLongWindows
                                                                                                                    • String ID: T1t
                                                                                                                    • API String ID: 3814560230-96595433
                                                                                                                    • Opcode ID: dd2db562366cd37b3f345f0e83b12bcb0ae3195bb958115aff716b9f035881bf
                                                                                                                    • Instruction ID: 8acdbee6c953777f3fd33529b85945bf1a4243300c66eb93d1d0224b4405bccf
                                                                                                                    • Opcode Fuzzy Hash: dd2db562366cd37b3f345f0e83b12bcb0ae3195bb958115aff716b9f035881bf
                                                                                                                    • Instruction Fuzzy Hash: 3A212775204201DFC734DF28D860AE6B3E5EF49321FA54759E86A873E0DB79AC44CB64
                                                                                                                    Function 007598FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                      • Part of subcall function 0070D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0070D1BA
                                                                                                                      • Part of subcall function 0070D17C: GetStockObject.GDI32(00000011), ref: 0070D1CE
                                                                                                                      • Part of subcall function 0070D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0070D1D8
                                                                                                                    • GetWindowRect.USER32(00000000,?), ref: 00759968
                                                                                                                    • GetSysColor.USER32(00000012), ref: 00759982
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                                                                    • String ID: static
                                                                                                                    • API String ID: 1983116058-2160076837
                                                                                                                    • Opcode ID: 2692e8d22cacda5779f6e20c83dd84512d0f0f34a06a154500fbb547ef6f416d
                                                                                                                    • Instruction ID: 560caea25c5f62965225f70289d45c4b41a4de6027897492c35aa6ca236ed7de
                                                                                                                    • Opcode Fuzzy Hash: 2692e8d22cacda5779f6e20c83dd84512d0f0f34a06a154500fbb547ef6f416d
                                                                                                                    • Instruction Fuzzy Hash: 9B111472520209EFDB14DFB8C845AEA7BB8FF48355F014628FE55E2250E778E854DB60
                                                                                                                    Function 00759617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetWindowTextLengthW.USER32(00000000), ref: 00759699
                                                                                                                    • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007596A8
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: LengthMessageSendTextWindow
                                                                                                                    • String ID: edit
                                                                                                                    • API String ID: 2978978980-2167791130
                                                                                                                    • Opcode ID: d93c2b3d29e6a143c07ecef8d1e9ae45c65f1b5147342b9d07a9bfa1dcee02a3
                                                                                                                    • Instruction ID: c7fdd851915f2dcc98f6937c6ce38f94dad14c373068af4387ec8e2f2c6d74c1
                                                                                                                    • Opcode Fuzzy Hash: d93c2b3d29e6a143c07ecef8d1e9ae45c65f1b5147342b9d07a9bfa1dcee02a3
                                                                                                                    • Instruction Fuzzy Hash: C2116A71500208EBEB209FA4DC84EEB3B6AEB053B9F504314FE65971E0C7B9DC589B64
                                                                                                                    Function 00735262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • _memset.LIBCMT ref: 007352D5
                                                                                                                    • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 007352F4
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: InfoItemMenu_memset
                                                                                                                    • String ID: 0
                                                                                                                    • API String ID: 2223754486-4108050209
                                                                                                                    • Opcode ID: 7cc33dfc94cdb3372ac18987e99d6e49f10b92fca0e388fbc02fd69498b64e10
                                                                                                                    • Instruction ID: 42e2a60d2bf8ab57ee18e07108d432e64cb243aff8045f7c5ac0e71862238ce5
                                                                                                                    • Opcode Fuzzy Hash: 7cc33dfc94cdb3372ac18987e99d6e49f10b92fca0e388fbc02fd69498b64e10
                                                                                                                    • Instruction Fuzzy Hash: 8D110472901614EBEB20DF98DD04F9E77B8AB05794F140125E942E7292D3B8ED04C7D2
                                                                                                                    Function 00744D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00744DF5
                                                                                                                    • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00744E1E
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Internet$OpenOption
                                                                                                                    • String ID: <local>
                                                                                                                    • API String ID: 942729171-4266983199
                                                                                                                    • Opcode ID: d7d0791d44b4b74acd702efd4d687b3085cf3b8efd0df5bd22f6346e43743fbc
                                                                                                                    • Instruction ID: 24aa6f465ddee4ea4771d917f0c4c8b6a20b64ecfbc4ffbedd775ae8c7b67e23
                                                                                                                    • Opcode Fuzzy Hash: d7d0791d44b4b74acd702efd4d687b3085cf3b8efd0df5bd22f6346e43743fbc
                                                                                                                    • Instruction Fuzzy Hash: 92118270A01221FBDB298F51CC89FFBFBA8FF16795F10822AF61556140D3785980EAE0
                                                                                                                    Function 0071A70C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 007237A7
                                                                                                                    • ___raise_securityfailure.LIBCMT ref: 0072388E
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                                                    • String ID: ({
                                                                                                                    • API String ID: 3761405300-3144030387
                                                                                                                    • Opcode ID: 809fb1c031359bfc675b7d629c446b09ff7f8c2978a98bfdd73a236674dfb5d3
                                                                                                                    • Instruction ID: d382bf14015959d6a6142ac648a03c267211abf8b162314543968176d0978cc1
                                                                                                                    • Opcode Fuzzy Hash: 809fb1c031359bfc675b7d629c446b09ff7f8c2978a98bfdd73a236674dfb5d3
                                                                                                                    • Instruction Fuzzy Hash: EC21E4B5601204DAD740EF25F986B423BB4BB48350F10DA6AE504863A1E3BCE980CBCD
                                                                                                                    Function 0074A82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 0074A84E
                                                                                                                    • htons.WSOCK32(00000000,?,00000000), ref: 0074A88B
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: htonsinet_addr
                                                                                                                    • String ID: 255.255.255.255
                                                                                                                    • API String ID: 3832099526-2422070025
                                                                                                                    • Opcode ID: 0220ad7547d7d482e2f0cfc5dea306f0b415f44c06e2a4312396f03a52864976
                                                                                                                    • Instruction ID: 22a8591cb0bf035b0fcb9a2ea64e67c4d5298fe8397ef548e9c8a5ea96a2d445
                                                                                                                    • Opcode Fuzzy Hash: 0220ad7547d7d482e2f0cfc5dea306f0b415f44c06e2a4312396f03a52864976
                                                                                                                    • Instruction Fuzzy Hash: 8F01F579240305BBCB229F68C88AFADB36CEF45360F10852AF516AB3D1D779E801C756
                                                                                                                    Function 0072B781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 0072B7EF
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend
                                                                                                                    • String ID: ComboBox$ListBox
                                                                                                                    • API String ID: 3850602802-1403004172
                                                                                                                    • Opcode ID: 7f74e1b76b79e29d373c71a8077536c46f9f07bb7acaac15b3fc0641aecf8da4
                                                                                                                    • Instruction ID: 1ee588c6feb4f2a54c91c4fd50214235bf1cffff4c9f5bc3340faf4919cb3db0
                                                                                                                    • Opcode Fuzzy Hash: 7f74e1b76b79e29d373c71a8077536c46f9f07bb7acaac15b3fc0641aecf8da4
                                                                                                                    • Instruction Fuzzy Hash: 90014C7160012CABCB44FBA8DC42DFE33B9BF46360B04061DF561A32C2DB785C188794
                                                                                                                    Function 0072B67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,00000180,00000000,?), ref: 0072B6EB
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend
                                                                                                                    • String ID: ComboBox$ListBox
                                                                                                                    • API String ID: 3850602802-1403004172
                                                                                                                    • Opcode ID: bfc733b5f69ef1604523e3b2ffc0912e6ce4613b175e7660e863c7f14de76eb7
                                                                                                                    • Instruction ID: b2237f00e58e9d29856106970678ca218558fb9cb6013216a34847c86fce66c2
                                                                                                                    • Opcode Fuzzy Hash: bfc733b5f69ef1604523e3b2ffc0912e6ce4613b175e7660e863c7f14de76eb7
                                                                                                                    • Instruction Fuzzy Hash: D101A2B564101CABCB54EBA8DA53EFE73A99F05344F10001DB502B3192DB986E1987B9
                                                                                                                    Function 0072B700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • SendMessageW.USER32(?,00000182,?,00000000), ref: 0072B76C
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: MessageSend
                                                                                                                    • String ID: ComboBox$ListBox
                                                                                                                    • API String ID: 3850602802-1403004172
                                                                                                                    • Opcode ID: 34f08351019c3811a1a5abfbbeac50dcb5e238559ae0ee0f408a41a826d65404
                                                                                                                    • Instruction ID: 63a3b76e89e0fba1da3e952a10e62a1f28d4f0325f401329e7092b971f65f343
                                                                                                                    • Opcode Fuzzy Hash: 34f08351019c3811a1a5abfbbeac50dcb5e238559ae0ee0f408a41a826d65404
                                                                                                                    • Instruction Fuzzy Hash: F201D6B564011CABCB10F7A8DA03EFE73AD9F05344F10001EB501B3292DB685E1997B9
                                                                                                                    Function 00714D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: __calloc_crt
                                                                                                                    • String ID: "{
                                                                                                                    • API String ID: 3494438863-2220128776
                                                                                                                    • Opcode ID: d291ac898b434de15f1ddb880635ebc016a95ff122b533421c7d647d3a59d33a
                                                                                                                    • Instruction ID: fb4d2add9368f87dbf739917567526019775d5aae58132c709ca7b49cd561f7c
                                                                                                                    • Opcode Fuzzy Hash: d291ac898b434de15f1ddb880635ebc016a95ff122b533421c7d647d3a59d33a
                                                                                                                    • Instruction Fuzzy Hash: 3EF0C87130A6119AEB289B1DFC45BE667D4F705720B11832EF300CA2D6E73CC8C28798
                                                                                                                    Function 006F4024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • LoadImageW.USER32(006F0000,00000063,00000001,00000010,00000010,00000000), ref: 006F4048
                                                                                                                    • EnumResourceNamesW.KERNEL32(00000000,0000000E,007367E9,00000063,00000000,75A50280,?,?,006F3EE1,?,?,000000FF), ref: 007641B3
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: EnumImageLoadNamesResource
                                                                                                                    • String ID: >o
                                                                                                                    • API String ID: 1578290342-2029646632
                                                                                                                    • Opcode ID: 025ee6c9fe1e8d6fea717eafc420389d23ffa96a7bfa3cabbc64945a2af66145
                                                                                                                    • Instruction ID: cc7e158e9867f5671ff7605b69b80e45ff0a7473df85324490c7ef3f59cd223e
                                                                                                                    • Opcode Fuzzy Hash: 025ee6c9fe1e8d6fea717eafc420389d23ffa96a7bfa3cabbc64945a2af66145
                                                                                                                    • Instruction Fuzzy Hash: DAF0967164031877E2305B19BC9AFD33B6DE715BF5F908206F714961E0D2F894C08698
                                                                                                                    Function 00737744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: ClassName_wcscmp
                                                                                                                    • String ID: #32770
                                                                                                                    • API String ID: 2292705959-463685578
                                                                                                                    • Opcode ID: b19ff14ca188bfce9c235abf0a6222d9a41fb0794873fe5b85ce5aec08b8d61a
                                                                                                                    • Instruction ID: e19af88b290a731046edd94d18a745dabc496d33da621c42c463b81517e53bea
                                                                                                                    • Opcode Fuzzy Hash: b19ff14ca188bfce9c235abf0a6222d9a41fb0794873fe5b85ce5aec08b8d61a
                                                                                                                    • Instruction Fuzzy Hash: 51E0927760422467D720AAA99C0AFC7FBACAB917A4F00411AB905E7082D678AA4187D4
                                                                                                                    Function 0072A631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 0072A63F
                                                                                                                      • Part of subcall function 007113F1: _doexit.LIBCMT ref: 007113FB
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: Message_doexit
                                                                                                                    • String ID: AutoIt$Error allocating memory.
                                                                                                                    • API String ID: 1993061046-4017498283
                                                                                                                    • Opcode ID: 27d91f62775409ca5ca1f9f10c4e3311a4348003b37287a554299e0372493253
                                                                                                                    • Instruction ID: 90b11a4384c43567d13c5aa6b9ecbddef18576f0b2e852039286e6b0bc517c29
                                                                                                                    • Opcode Fuzzy Hash: 27d91f62775409ca5ca1f9f10c4e3311a4348003b37287a554299e0372493253
                                                                                                                    • Instruction Fuzzy Hash: 4BD012722C432873D224369C6C1BFD566889B15F91F044019BB08A55C259DE9A9042DA
                                                                                                                    Function 0076AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • GetSystemDirectoryW.KERNEL32(?), ref: 0076ACC0
                                                                                                                    • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0076AEBD
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: DirectoryFreeLibrarySystem
                                                                                                                    • String ID: WIN_XPe
                                                                                                                    • API String ID: 510247158-3257408948
                                                                                                                    • Opcode ID: 5a5a5f3850eb3c8e0cf0e9474c59979bf9c9be51c465eb43a85bfa5953c53fcb
                                                                                                                    • Instruction ID: b65fb6516eb78d0dbf456dfb3ae01cb53b474bed1ef253c8178601f391f2436e
                                                                                                                    • Opcode Fuzzy Hash: 5a5a5f3850eb3c8e0cf0e9474c59979bf9c9be51c465eb43a85bfa5953c53fcb
                                                                                                                    • Instruction Fuzzy Hash: 7EE039B0C00609EFCB21DBA8D948AECB7B8AB48300F149181E443B2560CB385A84DF36
                                                                                                                    Function 007586CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007586E2
                                                                                                                    • PostMessageW.USER32(00000000), ref: 007586E9
                                                                                                                      • Part of subcall function 00737A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00737AD0
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: FindMessagePostSleepWindow
                                                                                                                    • String ID: Shell_TrayWnd
                                                                                                                    • API String ID: 529655941-2988720461
                                                                                                                    • Opcode ID: 797a06c561d9d1911bdfafc5c5dc2b2fadf24b17df88b1412e8e501aa01d501b
                                                                                                                    • Instruction ID: 7d08ec6f813d9efd231b58d7665a712c6327134310992550abaa0a7d1a1448e8
                                                                                                                    • Opcode Fuzzy Hash: 797a06c561d9d1911bdfafc5c5dc2b2fadf24b17df88b1412e8e501aa01d501b
                                                                                                                    • Instruction Fuzzy Hash: 48D0A9B1380318ABF23867309C0BFC62A289B05B60F104904B249EA0C0C8A8AD90C628
                                                                                                                    Function 00758698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                                                    Download Yara Rule
                                                                                                                    APIs
                                                                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007586A2
                                                                                                                    • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 007586B5
                                                                                                                      • Part of subcall function 00737A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00737AD0
                                                                                                                    Strings
                                                                                                                    Memory Dump Source
                                                                                                                    • Source File: 00000000.00000002.1319406468.00000000006F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                    • Associated: 00000000.00000002.1319380024.00000000006F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000077D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319484699.000000000079E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319558614.00000000007AA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    • Associated: 00000000.00000002.1319583311.00000000007B4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                    • Snapshot File: hcaresult_0_2_6f0000_NEW ORDER_.jbxd
                                                                                                                    Similarity
                                                                                                                    • API ID: FindMessagePostSleepWindow
                                                                                                                    • String ID: Shell_TrayWnd
                                                                                                                    • API String ID: 529655941-2988720461
                                                                                                                    • Opcode ID: e36d07fc46bcf0a139e3ea5d48d4c0a643ca597c30643d5834ac965db95d3e20
                                                                                                                    • Instruction ID: 4ad67e8a33ab3efd4aa3023c5129f015b780e2d914548b9705341280421294dc
                                                                                                                    • Opcode Fuzzy Hash: e36d07fc46bcf0a139e3ea5d48d4c0a643ca597c30643d5834ac965db95d3e20
                                                                                                                    • Instruction Fuzzy Hash: 5CD0A9B1384318A7E23867309C0BFC62A289F00B60F104904B24DAA0C0C8A8AD90C628