Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
brief nr. 001150_51_2024-11-19_134943.docx.exe

Overview

General Information

Sample name:brief nr. 001150_51_2024-11-19_134943.docx.exe
Analysis ID:1562319
MD5:b333b741b51e1fa861d44c2846939182
SHA1:1fe1597be441315cb76e8bfddf97c2344a5d206a
SHA256:4a85bac71b81338df2e724c587995e231dfc0b32b004cfea253b8d94422cc4ba
Tags:exeuser-adrian__luca
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • brief nr. 001150_51_2024-11-19_134943.docx.exe (PID: 6892 cmdline: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe" MD5: B333B741B51E1FA861D44C2846939182)
    • svchost.exe (PID: 5128 cmdline: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • help.exe (PID: 1836 cmdline: "C:\Windows\SysWOW64\help.exe" MD5: DD40774E56D4C44B81F2DFA059285E75)
          • cmd.exe (PID: 3232 cmdline: /c del "C:\Windows\SysWOW64\svchost.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 6300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.2creativedesign.online/ud04/"], "decoy": ["oum7.pro", "ovonordisk.online", "akrzus.pro", "tendmtedcpsa.site", "mm.foo", "animevyhgsft29817.click", "digdxxb.info", "1130.vip", "uy-now-pay-later-74776.bond", "ybzert.online", "edcn.link", "rime-flow-bay.xyz", "nd777id.beauty", "otoyama.shop", "lranchomx.xyz", "unluoren.top", "uglesang-troms.net", "udulbet88.net", "raquewear.shop", "ijanarko.net", "iuxy.host", "itaxia.dev", "hisewntbqg.makeup", "talianfood.store", "22gxx.app", "tandkite.fun", "rovideoeditor.shop", "ires-86307.bond", "elitjatarjoukset.click", "rofilern.net", "uycarpaylater-02-t1e-01.today", "futurum.xyz", "inance15.site", "alance-ton-budget.net", "tpuniplay.shop", "dlpli.xyz", "riteon.online", "rippyshaker.shop", "rn10.top", "linko1win.icu", "ugeniolopez.art", "raphic-design-degree-68380.bond", "narchists.info", "uy-now-pay-later-25573.bond", "gzvmt.info", "df.clinic", "onesome.store", "imba-168.net", "ayef.xyz", "64axyozkgl.top", "dult-diapers-53774.bond", "ec.baby", "el-radu-easy4y.one", "asik-eye-surgery-63293.bond", "p-inbox4.click", "0417.one", "ualitystore.shop", "partments-for-rent-61932.bond", "enobscotlobster.online", "fhou.link", "eo56a3oouu.top", "cweb.cyou", "hoe-organizer-za.today", "p806.top"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cba0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b907:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c90a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0x18829:$sqlite3step: 68 34 1C 7B E1
      • 0x1893c:$sqlite3step: 68 34 1C 7B E1
      • 0x18858:$sqlite3text: 68 38 2A 90 C5
      • 0x1897d:$sqlite3text: 68 38 2A 90 C5
      • 0x1886b:$sqlite3blob: 68 53 D8 7F 8C
      • 0x18993:$sqlite3blob: 68 53 D8 7F 8C
      Click to see the 33 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x5451:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1bda0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x9bcf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x14ab7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1ab07:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1bb0a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x17a29:$sqlite3step: 68 34 1C 7B E1
          • 0x17b3c:$sqlite3step: 68 34 1C 7B E1
          • 0x17a58:$sqlite3text: 68 38 2A 90 C5
          • 0x17b7d:$sqlite3text: 68 38 2A 90 C5
          • 0x17a6b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x17b93:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 15 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Suspicious Double Extension File Execution
          Source: Process startedAuthor: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe", CommandLine: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe, NewProcessName: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe, OriginalFileName: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe", ProcessId: 6892, ProcessName: brief nr. 001150_51_2024-11-19_134943.docx.exe
          Sigma detected: Uncommon Svchost Parent Process
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe", CommandLine: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe", ParentImage: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe, ParentProcessId: 6892, ParentProcessName: brief nr. 001150_51_2024-11-19_134943.docx.exe, ProcessCommandLine: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe", ProcessId: 5128, ProcessName: svchost.exe
          Sigma detected: Windows Processes Suspicious Parent Directory
          Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe", CommandLine: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe", ParentImage: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe, ParentProcessId: 6892, ParentProcessName: brief nr. 001150_51_2024-11-19_134943.docx.exe, ProcessCommandLine: "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe", ProcessId: 5128, ProcessName: svchost.exe

          Suricata Signatures

          ⊘No Suricata rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus detection for URL or domain
          Source: http://www.ybzert.online/ud04/www.iuxy.hostAvira URL Cloud: Label: malware
          Found malware configuration
          Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.2creativedesign.online/ud04/"], "decoy": ["oum7.pro", "ovonordisk.online", "akrzus.pro", "tendmtedcpsa.site", "mm.foo", "animevyhgsft29817.click", "digdxxb.info", "1130.vip", "uy-now-pay-later-74776.bond", "ybzert.online", "edcn.link", "rime-flow-bay.xyz", "nd777id.beauty", "otoyama.shop", "lranchomx.xyz", "unluoren.top", "uglesang-troms.net", "udulbet88.net", "raquewear.shop", "ijanarko.net", "iuxy.host", "itaxia.dev", "hisewntbqg.makeup", "talianfood.store", "22gxx.app", "tandkite.fun", "rovideoeditor.shop", "ires-86307.bond", "elitjatarjoukset.click", "rofilern.net", "uycarpaylater-02-t1e-01.today", "futurum.xyz", "inance15.site", "alance-ton-budget.net", "tpuniplay.shop", "dlpli.xyz", "riteon.online", "rippyshaker.shop", "rn10.top", "linko1win.icu", "ugeniolopez.art", "raphic-design-degree-68380.bond", "narchists.info", "uy-now-pay-later-25573.bond", "gzvmt.info", "df.clinic", "onesome.store", "imba-168.net", "ayef.xyz", "64axyozkgl.top", "dult-diapers-53774.bond", "ec.baby", "el-radu-easy4y.one", "asik-eye-surgery-63293.bond", "p-inbox4.click", "0417.one", "ualitystore.shop", "partments-for-rent-61932.bond", "enobscotlobster.online", "fhou.link", "eo56a3oouu.top", "cweb.cyou", "hoe-organizer-za.today", "p806.top"]}
          Multi AV Scanner detection for submitted file
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeReversingLabs: Detection: 60%
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for sample
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeJoe Sandbox ML: detected
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: Binary string: wntdll.pdbUGP source: brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000003.1302645918.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000003.1292477346.0000000003C60000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1376323784.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1304903181.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1302933842.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1376323784.000000000379E000.00000040.00001000.00020000.00000000.sdmp, help.exe, 0000000A.00000003.1377203029.0000000003597000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2544237781.0000000003740000.00000040.00001000.00020000.00000000.sdmp, help.exe, 0000000A.00000003.1374089320.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2544237781.00000000038DE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000003.1302645918.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000003.1292477346.0000000003C60000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000007.00000002.1376323784.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1304903181.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1302933842.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1376323784.000000000379E000.00000040.00001000.00020000.00000000.sdmp, help.exe, help.exe, 0000000A.00000003.1377203029.0000000003597000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2544237781.0000000003740000.00000040.00001000.00020000.00000000.sdmp, help.exe, 0000000A.00000003.1374089320.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2544237781.00000000038DE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: help.pdbGCTL source: svchost.exe, 00000007.00000002.1375949979.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1375873034.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1377302953.0000000003980000.00000040.10000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.2542427083.00000000009C0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdb source: explorer.exe, 00000008.00000002.2560940582.0000000010FEF000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.2543123488.0000000003160000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2545033862.0000000003C8F000.00000004.10000000.00040000.00000000.sdmp
          Source: Binary string: help.pdb source: svchost.exe, 00000007.00000002.1375949979.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1375873034.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1377302953.0000000003980000.00000040.10000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.2542427083.00000000009C0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdbUGP source: explorer.exe, 00000008.00000002.2560940582.0000000010FEF000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.2543123488.0000000003160000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2545033862.0000000003C8F000.00000004.10000000.00040000.00000000.sdmp
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00406CA9 GetFileAttributesW,FindFirstFileW,FindClose,4_2_00406CA9
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_004060DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,4_2_004060DD
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_004063F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,4_2_004063F9
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0040EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,4_2_0040EB60
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0040F56F FindFirstFileW,FindClose,4_2_0040F56F
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0040F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,4_2_0040F5FA
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00411B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,4_2_00411B2F
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00411C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,4_2_00411C8A
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00411F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,4_2_00411F94
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 4x nop then pop ebx7_2_00407B28
          Source: C:\Windows\SysWOW64\help.exeCode function: 4x nop then pop ebx10_2_030B7B28

          Networking

          barindex
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.2creativedesign.online/ud04/
          Source: unknownDNS traffic detected: query: www.2creativedesign.online replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.edcn.link replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.unluoren.top replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.narchists.info replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: www.ec.baby replaycode: Name error (3)
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00414EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,4_2_00414EB5
          Source: global trafficDNS traffic detected: DNS query: www.unluoren.top
          Source: global trafficDNS traffic detected: DNS query: www.narchists.info
          Source: global trafficDNS traffic detected: DNS query: www.ec.baby
          Source: global trafficDNS traffic detected: DNS query: www.2creativedesign.online
          Source: global trafficDNS traffic detected: DNS query: www.edcn.link
          Source: explorer.exe, 00000008.00000000.1313732014.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2553898092.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2273025067.000000000730A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: explorer.exe, 00000008.00000000.1313732014.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2553898092.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2273025067.000000000730A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: explorer.exe, 00000008.00000000.1313732014.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2553898092.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2273025067.000000000730A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: explorer.exe, 00000008.00000000.1313732014.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2553898092.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2273025067.000000000730A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
          Source: explorer.exe, 00000008.00000002.2552467444.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000003.2273196874.000000000C123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1317036232.000000000C10B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2550734202.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.1312390710.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000002.2558687782.000000000C124000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: explorer.exe, 00000008.00000003.2273196874.000000000C123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1317036232.000000000C10B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2558687782.000000000C124000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.microsoft.
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.1130.vip
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.1130.vip/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.1130.vip/ud04/www.el-radu-easy4y.one
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.1130.vipReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2creativedesign.online
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2creativedesign.online/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2creativedesign.online/ud04/www.edcn.link
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2creativedesign.onlineReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.akrzus.pro
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.akrzus.pro/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.akrzus.pro/ud04/www.gzvmt.info
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.akrzus.proReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asik-eye-surgery-63293.bond
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asik-eye-surgery-63293.bond/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asik-eye-surgery-63293.bond/ud04/www.rofilern.net
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.asik-eye-surgery-63293.bondReferer:
          Source: explorer.exe, 00000008.00000003.2272193145.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271217508.000000000C41F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1317036232.000000000C3F7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.df.clinic
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.df.clinic/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.df.clinic/ud04/www.lranchomx.xyz
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.df.clinicReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ec.baby
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ec.baby/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ec.baby/ud04/www.2creativedesign.online
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ec.babyReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.edcn.link
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.edcn.link/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.edcn.link/ud04/www.ybzert.online
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.edcn.linkReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.el-radu-easy4y.one
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.el-radu-easy4y.one/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.el-radu-easy4y.one/ud04/www.asik-eye-surgery-63293.bond
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.el-radu-easy4y.oneReferer:
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.foreca.com
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gzvmt.info
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gzvmt.info/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gzvmt.info/ud04/P
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gzvmt.infoReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iuxy.host
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iuxy.host/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iuxy.host/ud04/www.df.clinic
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iuxy.hostReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lranchomx.xyz
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lranchomx.xyz/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lranchomx.xyz/ud04/www.1130.vip
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.lranchomx.xyzReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.narchists.info
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.narchists.info/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.narchists.info/ud04/www.ec.baby
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.narchists.infoReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rofilern.net
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rofilern.net/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rofilern.net/ud04/www.uy-now-pay-later-74776.bond
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rofilern.netReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.unluoren.top
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.unluoren.top/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.unluoren.top/ud04/www.narchists.info
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.unluoren.topReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uy-now-pay-later-74776.bond
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uy-now-pay-later-74776.bond/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uy-now-pay-later-74776.bond/ud04/www.akrzus.pro
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uy-now-pay-later-74776.bondReferer:
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ybzert.online
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ybzert.online/ud04/
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ybzert.online/ud04/www.iuxy.host
          Source: explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ybzert.onlineReferer:
          Source: explorer.exe, 00000008.00000000.1313732014.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2553898092.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
          Source: explorer.exe, 00000008.00000003.2271278788.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1313732014.000000000913F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 00000008.00000002.2553898092.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 00000008.00000002.2553898092.0000000008DB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 00000008.00000000.1313732014.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2553898092.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
          Source: explorer.exe, 00000008.00000002.2547244184.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.0000000007276000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?t
          Source: explorer.exe, 00000008.00000002.2553898092.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1313732014.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
          Source: explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
          Source: explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
          Source: explorer.exe, 00000008.00000000.1317036232.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2558094598.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
          Source: explorer.exe, 00000008.00000000.1317036232.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2558094598.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
          Source: explorer.exe, 00000008.00000000.1317036232.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2558094598.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.com
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000008.00000002.2553898092.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1313732014.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.00000000090F2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/
          Source: explorer.exe, 00000008.00000000.1317036232.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2558094598.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
          Source: explorer.exe, 00000008.00000002.2547244184.00000000071A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.pollensense.com/
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00416B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,4_2_00416B0C
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00416D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,4_2_00416D07
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00416B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,4_2_00416B0C
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00402B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,4_2_00402B37

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: brief nr. 001150_51_2024-11-19_134943.docx.exe PID: 6892, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: svchost.exe PID: 5128, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: help.exe PID: 1836, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Binary is likely a compiled AutoIt script file
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: This is a third-party compiled AutoIt script.4_2_003C3D19
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeString found in binary or memory: This is a third-party compiled AutoIt script.
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_8bfde7dd-7
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: ?SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_77f0240a-3
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_55b665da-3
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeString found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_bd7e9d00-8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041A340 NtCreateFile,7_2_0041A340
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041A3F0 NtReadFile,7_2_0041A3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041A470 NtClose,7_2_0041A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041A520 NtAllocateVirtualMemory,7_2_0041A520
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041A3EB NtReadFile,7_2_0041A3EB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041A392 NtCreateFile,NtReadFile,7_2_0041A392
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041A51C NtAllocateVirtualMemory,7_2_0041A51C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672B60 NtClose,LdrInitializeThunk,7_2_03672B60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672BF0 NtAllocateVirtualMemory,LdrInitializeThunk,7_2_03672BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672AD0 NtReadFile,LdrInitializeThunk,7_2_03672AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672F30 NtCreateSection,LdrInitializeThunk,7_2_03672F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672FE0 NtCreateFile,LdrInitializeThunk,7_2_03672FE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672FB0 NtResumeThread,LdrInitializeThunk,7_2_03672FB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672F90 NtProtectVirtualMemory,LdrInitializeThunk,7_2_03672F90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,7_2_03672EA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672E80 NtReadVirtualMemory,LdrInitializeThunk,7_2_03672E80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672D30 NtUnmapViewOfSection,LdrInitializeThunk,7_2_03672D30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672D10 NtMapViewOfSection,LdrInitializeThunk,7_2_03672D10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672DF0 NtQuerySystemInformation,LdrInitializeThunk,7_2_03672DF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672DD0 NtDelayExecution,LdrInitializeThunk,7_2_03672DD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672C70 NtFreeVirtualMemory,LdrInitializeThunk,7_2_03672C70
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672CA0 NtQueryInformationToken,LdrInitializeThunk,7_2_03672CA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03674340 NtSetContextThread,7_2_03674340
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03674650 NtSuspendThread,7_2_03674650
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672BE0 NtQueryValueKey,7_2_03672BE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672BA0 NtEnumerateValueKey,7_2_03672BA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672B80 NtQueryInformationFile,7_2_03672B80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672AF0 NtWriteFile,7_2_03672AF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672AB0 NtWaitForSingleObject,7_2_03672AB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672F60 NtCreateProcessEx,7_2_03672F60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672FA0 NtQuerySection,7_2_03672FA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672E30 NtWriteVirtualMemory,7_2_03672E30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672EE0 NtQueueApcThread,7_2_03672EE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672D00 NtSetInformationFile,7_2_03672D00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672DB0 NtEnumerateKey,7_2_03672DB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672C60 NtCreateKey,7_2_03672C60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672C00 NtQueryInformationProcess,7_2_03672C00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672CF0 NtOpenProcess,7_2_03672CF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672CC0 NtQueryVirtualMemory,7_2_03672CC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03673010 NtOpenDirectoryObject,7_2_03673010
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03673090 NtSetValueKey,7_2_03673090
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036735C0 NtCreateMutant,7_2_036735C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036739B0 NtGetContextThread,7_2_036739B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03673D70 NtOpenThread,7_2_03673D70
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03673D10 NtOpenProcessToken,7_2_03673D10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03ABA036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,NtClose,7_2_03ABA036
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03ABA042 NtQueryInformationProcess,7_2_03ABA042
          Source: C:\Windows\explorer.exeCode function: 8_2_107A3232 NtCreateFile,8_2_107A3232
          Source: C:\Windows\explorer.exeCode function: 8_2_107A4E12 NtProtectVirtualMemory,8_2_107A4E12
          Source: C:\Windows\explorer.exeCode function: 8_2_107A4E0A NtProtectVirtualMemory,8_2_107A4E0A
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2B60 NtClose,LdrInitializeThunk,10_2_037B2B60
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,10_2_037B2BF0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2BE0 NtQueryValueKey,LdrInitializeThunk,10_2_037B2BE0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2AD0 NtReadFile,LdrInitializeThunk,10_2_037B2AD0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2F30 NtCreateSection,LdrInitializeThunk,10_2_037B2F30
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2FE0 NtCreateFile,LdrInitializeThunk,10_2_037B2FE0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,10_2_037B2EA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2D10 NtMapViewOfSection,LdrInitializeThunk,10_2_037B2D10
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2DF0 NtQuerySystemInformation,LdrInitializeThunk,10_2_037B2DF0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2DD0 NtDelayExecution,LdrInitializeThunk,10_2_037B2DD0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2C70 NtFreeVirtualMemory,LdrInitializeThunk,10_2_037B2C70
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2C60 NtCreateKey,LdrInitializeThunk,10_2_037B2C60
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2CA0 NtQueryInformationToken,LdrInitializeThunk,10_2_037B2CA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B35C0 NtCreateMutant,LdrInitializeThunk,10_2_037B35C0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B4340 NtSetContextThread,10_2_037B4340
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B4650 NtSuspendThread,10_2_037B4650
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2BA0 NtEnumerateValueKey,10_2_037B2BA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2B80 NtQueryInformationFile,10_2_037B2B80
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2AF0 NtWriteFile,10_2_037B2AF0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2AB0 NtWaitForSingleObject,10_2_037B2AB0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2F60 NtCreateProcessEx,10_2_037B2F60
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2FB0 NtResumeThread,10_2_037B2FB0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2FA0 NtQuerySection,10_2_037B2FA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2F90 NtProtectVirtualMemory,10_2_037B2F90
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2E30 NtWriteVirtualMemory,10_2_037B2E30
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2EE0 NtQueueApcThread,10_2_037B2EE0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2E80 NtReadVirtualMemory,10_2_037B2E80
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2D30 NtUnmapViewOfSection,10_2_037B2D30
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2D00 NtSetInformationFile,10_2_037B2D00
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2DB0 NtEnumerateKey,10_2_037B2DB0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2C00 NtQueryInformationProcess,10_2_037B2C00
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2CF0 NtOpenProcess,10_2_037B2CF0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B2CC0 NtQueryVirtualMemory,10_2_037B2CC0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B3010 NtOpenDirectoryObject,10_2_037B3010
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B3090 NtSetValueKey,10_2_037B3090
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B39B0 NtGetContextThread,10_2_037B39B0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B3D70 NtOpenThread,10_2_037B3D70
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B3D10 NtOpenProcessToken,10_2_037B3D10
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030CA340 NtCreateFile,10_2_030CA340
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030CA3F0 NtReadFile,10_2_030CA3F0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030CA520 NtAllocateVirtualMemory,10_2_030CA520
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030CA470 NtClose,10_2_030CA470
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030CA392 NtCreateFile,NtReadFile,10_2_030CA392
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030CA3EB NtReadFile,10_2_030CA3EB
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030CA51C NtAllocateVirtualMemory,10_2_030CA51C
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03669BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,10_2_03669BAF
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0366A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,10_2_0366A036
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03669BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,10_2_03669BB2
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0366A042 NtQueryInformationProcess,10_2_0366A042
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00406606: CreateFileW,DeviceIoControl,CloseHandle,4_2_00406606
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003FACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,4_2_003FACC5
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_004079D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,4_2_004079D3
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003EB0434_2_003EB043
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003D32004_2_003D3200
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003D3B704_2_003D3B70
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003F410F4_2_003F410F
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003E02A44_2_003E02A4
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003F038E4_2_003F038E
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003CE3E34_2_003CE3E3
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003F467F4_2_003F467F
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003E06D94_2_003E06D9
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0042AACE4_2_0042AACE
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003F4BEF4_2_003F4BEF
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003ECCC14_2_003ECCC1
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003C6F074_2_003C6F07
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003CAF504_2_003CAF50
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003DB11F4_2_003DB11F
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003ED1B94_2_003ED1B9
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_004231BC4_2_004231BC
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003E123A4_2_003E123A
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003F724D4_2_003F724D
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_004013CA4_2_004013CA
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003C93F04_2_003C93F0
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003DF5634_2_003DF563
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0040B6CC4_2_0040B6CC
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003C96C04_2_003C96C0
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003C77B04_2_003C77B0
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003F79C94_2_003F79C9
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003DFA574_2_003DFA57
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003C9B604_2_003C9B60
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003C7D194_2_003C7D19
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003DFE6F4_2_003DFE6F
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003E9ED04_2_003E9ED0
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003C7FA34_2_003C7FA3
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0128CA684_2_0128CA68
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004010267_2_00401026
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004010307_2_00401030
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041E1B77_2_0041E1B7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041DA087_2_0041DA08
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00402D877_2_00402D87
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00402D907_2_00402D90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00409E5B7_2_00409E5B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00409E607_2_00409E60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00402FB07_2_00402FB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FA3527_2_036FA352
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364E3F07_2_0364E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_037003E67_2_037003E6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E02747_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C02C07_2_036C02C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C81587_2_036C8158
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036301007_2_03630100
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DA1187_2_036DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F81CC7_2_036F81CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F41A27_2_036F41A2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_037001AA7_2_037001AA
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D20007_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036407707_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036647507_2_03664750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363C7C07_2_0363C7C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365C6E07_2_0365C6E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036405357_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_037005917_2_03700591
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F24467_2_036F2446
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E44207_2_036E4420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036EE4F67_2_036EE4F6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FAB407_2_036FAB40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F6BD77_2_036F6BD7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363EA807_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036569627_2_03656962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A07_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0370A9A67_2_0370A9A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364A8407_2_0364A840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036428407_2_03642840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E8F07_2_0366E8F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036268B87_2_036268B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B4F407_2_036B4F40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03682F287_2_03682F28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03660F307_2_03660F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E2F307_2_036E2F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364CFE07_2_0364CFE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03632FC87_2_03632FC8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BEFA07_2_036BEFA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640E597_2_03640E59
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FEE267_2_036FEE26
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FEEDB7_2_036FEEDB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03652E907_2_03652E90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FCE937_2_036FCE93
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364AD007_2_0364AD00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DCD1F7_2_036DCD1F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363ADE07_2_0363ADE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03658DBF7_2_03658DBF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640C007_2_03640C00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03630CF27_2_03630CF2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0CB57_2_036E0CB5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362D34C7_2_0362D34C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F132D7_2_036F132D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0368739A7_2_0368739A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E12ED7_2_036E12ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365B2C07_2_0365B2C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036452A07_2_036452A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0367516C7_2_0367516C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362F1727_2_0362F172
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0370B16B7_2_0370B16B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364B1B07_2_0364B1B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F70E97_2_036F70E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FF0E07_2_036FF0E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036EF0CC7_2_036EF0CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036470C07_2_036470C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FF7B07_2_036FF7B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036856307_2_03685630
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F16CC7_2_036F16CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F75717_2_036F7571
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_037095C37_2_037095C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DD5B07_2_036DD5B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036314607_2_03631460
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FF43F7_2_036FF43F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FFB767_2_036FFB76
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B5BF07_2_036B5BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0367DBF97_2_0367DBF9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365FB807_2_0365FB80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B3A6C7_2_036B3A6C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FFA497_2_036FFA49
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F7A467_2_036F7A46
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036EDAC67_2_036EDAC6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DDAAC7_2_036DDAAC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03685AA07_2_03685AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E1AA37_2_036E1AA3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036499507_2_03649950
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365B9507_2_0365B950
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D59107_2_036D5910
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AD8007_2_036AD800
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036438E07_2_036438E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FFF097_2_036FFF09
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FFFB17_2_036FFFB1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03641F927_2_03641F92
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03649EB07_2_03649EB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F7D737_2_036F7D73
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03643D407_2_03643D40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F1D5A7_2_036F1D5A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365FDC07_2_0365FDC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B9C327_2_036B9C32
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FFCF27_2_036FFCF2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03ABA0367_2_03ABA036
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03ABB2327_2_03ABB232
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03AB10827_2_03AB1082
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03ABE5CD7_2_03ABE5CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03AB5B327_2_03AB5B32
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03AB5B307_2_03AB5B30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03AB89127_2_03AB8912
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03AB2D027_2_03AB2D02
          Source: C:\Windows\explorer.exeCode function: 8_2_107A32328_2_107A3232
          Source: C:\Windows\explorer.exeCode function: 8_2_107A20368_2_107A2036
          Source: C:\Windows\explorer.exeCode function: 8_2_107990828_2_10799082
          Source: C:\Windows\explorer.exeCode function: 8_2_1079DB308_2_1079DB30
          Source: C:\Windows\explorer.exeCode function: 8_2_1079DB328_2_1079DB32
          Source: C:\Windows\explorer.exeCode function: 8_2_107A09128_2_107A0912
          Source: C:\Windows\explorer.exeCode function: 8_2_1079AD028_2_1079AD02
          Source: C:\Windows\explorer.exeCode function: 8_2_107A65CD8_2_107A65CD
          Source: C:\Windows\explorer.exeCode function: 8_2_10C5D0828_2_10C5D082
          Source: C:\Windows\explorer.exeCode function: 8_2_10C660368_2_10C66036
          Source: C:\Windows\explorer.exeCode function: 8_2_10C6A5CD8_2_10C6A5CD
          Source: C:\Windows\explorer.exeCode function: 8_2_10C5ED028_2_10C5ED02
          Source: C:\Windows\explorer.exeCode function: 8_2_10C649128_2_10C64912
          Source: C:\Windows\explorer.exeCode function: 8_2_10C672328_2_10C67232
          Source: C:\Windows\explorer.exeCode function: 8_2_10C61B328_2_10C61B32
          Source: C:\Windows\explorer.exeCode function: 8_2_10C61B308_2_10C61B30
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_038403E610_2_038403E6
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0378E3F010_2_0378E3F0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383A35210_2_0383A352
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_038002C010_2_038002C0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0382027410_2_03820274
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_038341A210_2_038341A2
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_038401AA10_2_038401AA
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_038381CC10_2_038381CC
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0377010010_2_03770100
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0381A11810_2_0381A118
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0380815810_2_03808158
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0381200010_2_03812000
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0378077010_2_03780770
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037A475010_2_037A4750
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0377C7C010_2_0377C7C0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0379C6E010_2_0379C6E0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0384059110_2_03840591
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0378053510_2_03780535
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0382E4F610_2_0382E4F6
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0382442010_2_03824420
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383244610_2_03832446
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03836BD710_2_03836BD7
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383AB4010_2_0383AB40
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0377EA8010_2_0377EA80
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0379696210_2_03796962
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0384A9A610_2_0384A9A6
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037829A010_2_037829A0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0378A84010_2_0378A840
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0378284010_2_03782840
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037AE8F010_2_037AE8F0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037668B810_2_037668B8
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037F4F4010_2_037F4F40
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037A0F3010_2_037A0F30
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037C2F2810_2_037C2F28
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0378CFE010_2_0378CFE0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03822F3010_2_03822F30
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03772FC810_2_03772FC8
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037FEFA010_2_037FEFA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383CE9310_2_0383CE93
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03780E5910_2_03780E59
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383EEDB10_2_0383EEDB
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383EE2610_2_0383EE26
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03792E9010_2_03792E90
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0378AD0010_2_0378AD00
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0377ADE010_2_0377ADE0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0381CD1F10_2_0381CD1F
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03798DBF10_2_03798DBF
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03820CB510_2_03820CB5
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03780C0010_2_03780C00
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03770CF210_2_03770CF2
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0376D34C10_2_0376D34C
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383132D10_2_0383132D
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037C739A10_2_037C739A
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_038212ED10_2_038212ED
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0379B2C010_2_0379B2C0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037852A010_2_037852A0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0376F17210_2_0376F172
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037B516C10_2_037B516C
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0378B1B010_2_0378B1B0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0384B16B10_2_0384B16B
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0382F0CC10_2_0382F0CC
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383F0E010_2_0383F0E0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_038370E910_2_038370E9
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037870C010_2_037870C0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383F7B010_2_0383F7B0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037C563010_2_037C5630
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_038316CC10_2_038316CC
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0381D5B010_2_0381D5B0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_038495C310_2_038495C3
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383757110_2_03837571
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0377146010_2_03771460
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383F43F10_2_0383F43F
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037BDBF910_2_037BDBF9
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037F5BF010_2_037F5BF0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383FB7610_2_0383FB76
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0379FB8010_2_0379FB80
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037F3A6C10_2_037F3A6C
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03821AA310_2_03821AA3
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0381DAAC10_2_0381DAAC
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0382DAC610_2_0382DAC6
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03837A4610_2_03837A46
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383FA4910_2_0383FA49
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037C5AA010_2_037C5AA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0378995010_2_03789950
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0379B95010_2_0379B950
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0381591010_2_03815910
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037ED80010_2_037ED800
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037838E010_2_037838E0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383FFB110_2_0383FFB1
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383FF0910_2_0383FF09
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03743FD510_2_03743FD5
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03743FD210_2_03743FD2
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03781F9210_2_03781F92
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03789EB010_2_03789EB0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03783D4010_2_03783D40
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0379FDC010_2_0379FDC0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03831D5A10_2_03831D5A
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03837D7310_2_03837D73
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037F9C3210_2_037F9C32
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0383FCF210_2_0383FCF2
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030CDA0810_2_030CDA08
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030B2FB010_2_030B2FB0
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030B9E5B10_2_030B9E5B
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030B9E6010_2_030B9E60
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030B2D8710_2_030B2D87
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030B2D9010_2_030B2D90
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0366A03610_2_0366A036
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03665B3210_2_03665B32
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03665B3010_2_03665B30
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0366B23210_2_0366B232
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0366891210_2_03668912
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0366108210_2_03661082
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03662D0210_2_03662D02
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0366E5CD10_2_0366E5CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 036AEA12 appears 86 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03675130 appears 58 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 036BF290 appears 105 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0362B970 appears 277 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03687E54 appears 111 times
          Source: C:\Windows\SysWOW64\help.exeCode function: String function: 037C7E54 appears 111 times
          Source: C:\Windows\SysWOW64\help.exeCode function: String function: 037FF290 appears 105 times
          Source: C:\Windows\SysWOW64\help.exeCode function: String function: 0376B970 appears 277 times
          Source: C:\Windows\SysWOW64\help.exeCode function: String function: 037B5130 appears 58 times
          Source: C:\Windows\SysWOW64\help.exeCode function: String function: 037EEA12 appears 86 times
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: String function: 003DEC2F appears 68 times
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: String function: 003E6AC0 appears 42 times
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: String function: 003EF8A0 appears 35 times
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000003.1302319110.0000000003DBD000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs brief nr. 001150_51_2024-11-19_134943.docx.exe
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000003.1290491643.0000000003BE3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs brief nr. 001150_51_2024-11-19_134943.docx.exe
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: brief nr. 001150_51_2024-11-19_134943.docx.exe PID: 6892, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: svchost.exe PID: 5128, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: help.exe PID: 1836, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: classification engineClassification label: mal100.troj.evad.winEXE@8/2@5/0
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0040CE7A GetLastError,FormatMessageW,4_2_0040CE7A
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003FAB84 AdjustTokenPrivileges,CloseHandle,4_2_003FAB84
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003FB134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,4_2_003FB134
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0040E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,4_2_0040E1FD
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00406532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,4_2_00406532
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0041C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,4_2_0041C18C
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003C406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,4_2_003C406B
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:120:WilError_03
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeFile created: C:\Users\user~1\AppData\Local\Temp\aut4CA8.tmpJump to behavior
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Windows\explorer.exeFile read: C:\Users\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeReversingLabs: Detection: 60%
          Source: unknownProcess created: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe"
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\help.exe "C:\Windows\SysWOW64\help.exe"
          Source: C:\Windows\SysWOW64\help.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\help.exe "C:\Windows\SysWOW64\help.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\help.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"Jump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: wsock32.dllJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: winmm.dllJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wpnapps.dllJump to behavior
          Source: C:\Windows\SysWOW64\help.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32Jump to behavior
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic file information: File size 1111552 > 1048576
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: wntdll.pdbUGP source: brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000003.1302645918.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000003.1292477346.0000000003C60000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1376323784.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1304903181.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1302933842.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1376323784.000000000379E000.00000040.00001000.00020000.00000000.sdmp, help.exe, 0000000A.00000003.1377203029.0000000003597000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2544237781.0000000003740000.00000040.00001000.00020000.00000000.sdmp, help.exe, 0000000A.00000003.1374089320.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2544237781.00000000038DE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000003.1302645918.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, brief nr. 001150_51_2024-11-19_134943.docx.exe, 00000004.00000003.1292477346.0000000003C60000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000007.00000002.1376323784.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1304903181.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1302933842.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1376323784.000000000379E000.00000040.00001000.00020000.00000000.sdmp, help.exe, help.exe, 0000000A.00000003.1377203029.0000000003597000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2544237781.0000000003740000.00000040.00001000.00020000.00000000.sdmp, help.exe, 0000000A.00000003.1374089320.00000000033D1000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2544237781.00000000038DE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: help.pdbGCTL source: svchost.exe, 00000007.00000002.1375949979.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1375873034.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1377302953.0000000003980000.00000040.10000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.2542427083.00000000009C0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdb source: explorer.exe, 00000008.00000002.2560940582.0000000010FEF000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.2543123488.0000000003160000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2545033862.0000000003C8F000.00000004.10000000.00040000.00000000.sdmp
          Source: Binary string: help.pdb source: svchost.exe, 00000007.00000002.1375949979.0000000003012000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1375873034.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.1377302953.0000000003980000.00000040.10000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.2542427083.00000000009C0000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdbUGP source: explorer.exe, 00000008.00000002.2560940582.0000000010FEF000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.2543123488.0000000003160000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.2545033862.0000000003C8F000.00000004.10000000.00040000.00000000.sdmp
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003DE01E LoadLibraryA,GetProcAddress,4_2_003DE01E
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003E6B05 push ecx; ret 4_2_003E6B18
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0128CC95 push edi; iretd 4_2_0128CC98
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0128CF82 push es; iretd 4_2_0128CF93
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00404905 push eax; iretd 7_2_0040490C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00417AD0 push ecx; ret 7_2_00417AD1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00416431 push 00000063h; ret 7_2_00416438
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041D4E2 push eax; ret 7_2_0041D4E8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041D4EB push eax; ret 7_2_0041D552
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00409C84 push esi; ret 7_2_00409C85
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041D495 push eax; ret 7_2_0041D4E8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041D54C push eax; ret 7_2_0041D552
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041973C push esi; retf 7_2_0041973D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036309AD push ecx; mov dword ptr [esp], ecx7_2_036309B6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0360135F push eax; iretd 7_2_03601369
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03ABEB02 push esp; retn 0000h7_2_03ABEB03
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03ABEB1E push esp; retn 0000h7_2_03ABEB1F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03ABE9B5 push esp; retn 0000h7_2_03ABEAE7
          Source: C:\Windows\explorer.exeCode function: 8_2_107A6B1E push esp; retn 0000h8_2_107A6B1F
          Source: C:\Windows\explorer.exeCode function: 8_2_107A6B02 push esp; retn 0000h8_2_107A6B03
          Source: C:\Windows\explorer.exeCode function: 8_2_107A69B5 push esp; retn 0000h8_2_107A6AE7
          Source: C:\Windows\explorer.exeCode function: 8_2_10C6A9B5 push esp; retn 0000h8_2_10C6AAE7
          Source: C:\Windows\explorer.exeCode function: 8_2_10C6AB02 push esp; retn 0000h8_2_10C6AB03
          Source: C:\Windows\explorer.exeCode function: 8_2_10C6AB1E push esp; retn 0000h8_2_10C6AB1F
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0374225F pushad ; ret 10_2_037427F9
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037427FA pushad ; ret 10_2_037427F9
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_037709AD push ecx; mov dword ptr [esp], ecx10_2_037709B6
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_0374283D push eax; iretd 10_2_03742858
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_03741350 push eax; iretd 10_2_03741369
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030C973C push esi; retf 10_2_030C973D
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030CD54C push eax; ret 10_2_030CD552
          Source: C:\Windows\SysWOW64\help.exeCode function: 10_2_030C6431 push 00000063h; ret 10_2_030C6438

          Hooking and other Techniques for Hiding and Protection

          barindex
          Modifies the prolog of user mode functions (user mode inline hooks)
          Source: explorer.exeUser mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x84 0x4E 0xEC
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00428111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,4_2_00428111
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003DEB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,4_2_003DEB42
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003E123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,4_2_003E123A
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\help.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Switches to a custom stack to bypass stack traces
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeAPI/Special instruction interceptor: Address: 128C68C
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFB2CECD944
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFB2CECD504
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFB2CECD544
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Windows\SysWOW64\svchost.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\svchost.exeRDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\help.exeRDTSC instruction interceptor: First address: 30B9904 second address: 30B990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\help.exeRDTSC instruction interceptor: First address: 30B9B7E second address: 30B9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00409AB0 rdtsc 7_2_00409AB0
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 2981Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 6968Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 901Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 851Jump to behavior
          Source: C:\Windows\SysWOW64\help.exeWindow / User API: threadDelayed 9806Jump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeEvaded block: after key decisiongraph_4-94743
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeEvaded block: after key decisiongraph_4-93518
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeAPI coverage: 4.6 %
          Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 2.0 %
          Source: C:\Windows\SysWOW64\help.exeAPI coverage: 2.2 %
          Source: C:\Windows\explorer.exe TID: 3088Thread sleep count: 2981 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 3088Thread sleep time: -5962000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 3088Thread sleep count: 6968 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 3088Thread sleep time: -13936000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\help.exe TID: 516Thread sleep count: 168 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\help.exe TID: 516Thread sleep time: -336000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\help.exe TID: 516Thread sleep count: 9806 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\help.exe TID: 516Thread sleep time: -19612000s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
          Source: C:\Windows\SysWOW64\help.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\help.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00406CA9 GetFileAttributesW,FindFirstFileW,FindClose,4_2_00406CA9
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_004060DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,4_2_004060DD
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_004063F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,4_2_004063F9
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0040EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,4_2_0040EB60
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0040F56F FindFirstFileW,FindClose,4_2_0040F56F
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0040F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,4_2_0040F5FA
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00411B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,4_2_00411B2F
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00411C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,4_2_00411C8A
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00411F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,4_2_00411F94
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003DDDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,4_2_003DDDC0
          Source: explorer.exe, 00000008.00000000.1307008242.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
          Source: explorer.exe, 00000008.00000002.2544847490.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
          Source: explorer.exe, 00000008.00000003.2271278788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
          Source: explorer.exe, 00000008.00000000.1313732014.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2553898092.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 00000008.00000002.2544847490.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
          Source: explorer.exe, 00000008.00000003.2271278788.0000000009013000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 00000008.00000002.2544847490.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
          Source: explorer.exe, 00000008.00000002.2544847490.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
          Source: explorer.exe, 00000008.00000003.2273025067.000000000730A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_xU1
          Source: explorer.exe, 00000008.00000003.2271278788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
          Source: explorer.exe, 00000008.00000002.2553898092.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
          Source: explorer.exe, 00000008.00000003.2271278788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
          Source: explorer.exe, 00000008.00000003.2271278788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
          Source: explorer.exe, 00000008.00000002.2553898092.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1313732014.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
          Source: explorer.exe, 00000008.00000002.2544847490.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware20,1
          Source: explorer.exe, 00000008.00000002.2544847490.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
          Source: explorer.exe, 00000008.00000003.2271278788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMWare
          Source: explorer.exe, 00000008.00000002.2553898092.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
          Source: explorer.exe, 00000008.00000003.2273025067.000000000730A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
          Source: explorer.exe, 00000008.00000003.2271278788.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1313732014.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2553898092.0000000008F27000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWT`
          Source: explorer.exe, 00000008.00000002.2544847490.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
          Source: explorer.exe, 00000008.00000002.2544847490.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
          Source: explorer.exe, 00000008.00000000.1307008242.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
          Source: explorer.exe, 00000008.00000002.2544847490.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
          Source: explorer.exe, 00000008.00000003.2271278788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000008.00000000.1307008242.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeAPI call chain: ExitProcess graph end nodegraph_4-93641
          Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\help.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00409AB0 rdtsc 7_2_00409AB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040ACF0 LdrLoadDll,7_2_0040ACF0
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00416AAF BlockInput,4_2_00416AAF
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003C3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,4_2_003C3D19
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003F3920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,4_2_003F3920
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003DE01E LoadLibraryA,GetProcAddress,4_2_003DE01E
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0128B2C8 mov eax, dword ptr fs:[00000030h]4_2_0128B2C8
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0128C958 mov eax, dword ptr fs:[00000030h]4_2_0128C958
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0128C8F8 mov eax, dword ptr fs:[00000030h]4_2_0128C8F8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D437C mov eax, dword ptr fs:[00000030h]7_2_036D437C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B2349 mov eax, dword ptr fs:[00000030h]7_2_036B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B035C mov eax, dword ptr fs:[00000030h]7_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B035C mov eax, dword ptr fs:[00000030h]7_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B035C mov eax, dword ptr fs:[00000030h]7_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B035C mov ecx, dword ptr fs:[00000030h]7_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B035C mov eax, dword ptr fs:[00000030h]7_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B035C mov eax, dword ptr fs:[00000030h]7_2_036B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FA352 mov eax, dword ptr fs:[00000030h]7_2_036FA352
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D8350 mov ecx, dword ptr fs:[00000030h]7_2_036D8350
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0370634F mov eax, dword ptr fs:[00000030h]7_2_0370634F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03708324 mov eax, dword ptr fs:[00000030h]7_2_03708324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03708324 mov ecx, dword ptr fs:[00000030h]7_2_03708324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03708324 mov eax, dword ptr fs:[00000030h]7_2_03708324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03708324 mov eax, dword ptr fs:[00000030h]7_2_03708324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366A30B mov eax, dword ptr fs:[00000030h]7_2_0366A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366A30B mov eax, dword ptr fs:[00000030h]7_2_0366A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366A30B mov eax, dword ptr fs:[00000030h]7_2_0366A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362C310 mov ecx, dword ptr fs:[00000030h]7_2_0362C310
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03650310 mov ecx, dword ptr fs:[00000030h]7_2_03650310
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036403E9 mov eax, dword ptr fs:[00000030h]7_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036403E9 mov eax, dword ptr fs:[00000030h]7_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036403E9 mov eax, dword ptr fs:[00000030h]7_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036403E9 mov eax, dword ptr fs:[00000030h]7_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036403E9 mov eax, dword ptr fs:[00000030h]7_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036403E9 mov eax, dword ptr fs:[00000030h]7_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036403E9 mov eax, dword ptr fs:[00000030h]7_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036403E9 mov eax, dword ptr fs:[00000030h]7_2_036403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364E3F0 mov eax, dword ptr fs:[00000030h]7_2_0364E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364E3F0 mov eax, dword ptr fs:[00000030h]7_2_0364E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364E3F0 mov eax, dword ptr fs:[00000030h]7_2_0364E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036663FF mov eax, dword ptr fs:[00000030h]7_2_036663FF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036EC3CD mov eax, dword ptr fs:[00000030h]7_2_036EC3CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A3C0 mov eax, dword ptr fs:[00000030h]7_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A3C0 mov eax, dword ptr fs:[00000030h]7_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A3C0 mov eax, dword ptr fs:[00000030h]7_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A3C0 mov eax, dword ptr fs:[00000030h]7_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A3C0 mov eax, dword ptr fs:[00000030h]7_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A3C0 mov eax, dword ptr fs:[00000030h]7_2_0363A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036383C0 mov eax, dword ptr fs:[00000030h]7_2_036383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036383C0 mov eax, dword ptr fs:[00000030h]7_2_036383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036383C0 mov eax, dword ptr fs:[00000030h]7_2_036383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036383C0 mov eax, dword ptr fs:[00000030h]7_2_036383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B63C0 mov eax, dword ptr fs:[00000030h]7_2_036B63C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE3DB mov eax, dword ptr fs:[00000030h]7_2_036DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE3DB mov eax, dword ptr fs:[00000030h]7_2_036DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE3DB mov ecx, dword ptr fs:[00000030h]7_2_036DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE3DB mov eax, dword ptr fs:[00000030h]7_2_036DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D43D4 mov eax, dword ptr fs:[00000030h]7_2_036D43D4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D43D4 mov eax, dword ptr fs:[00000030h]7_2_036D43D4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362E388 mov eax, dword ptr fs:[00000030h]7_2_0362E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362E388 mov eax, dword ptr fs:[00000030h]7_2_0362E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362E388 mov eax, dword ptr fs:[00000030h]7_2_0362E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365438F mov eax, dword ptr fs:[00000030h]7_2_0365438F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365438F mov eax, dword ptr fs:[00000030h]7_2_0365438F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03628397 mov eax, dword ptr fs:[00000030h]7_2_03628397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03628397 mov eax, dword ptr fs:[00000030h]7_2_03628397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03628397 mov eax, dword ptr fs:[00000030h]7_2_03628397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03634260 mov eax, dword ptr fs:[00000030h]7_2_03634260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03634260 mov eax, dword ptr fs:[00000030h]7_2_03634260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03634260 mov eax, dword ptr fs:[00000030h]7_2_03634260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362826B mov eax, dword ptr fs:[00000030h]7_2_0362826B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E0274 mov eax, dword ptr fs:[00000030h]7_2_036E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B8243 mov eax, dword ptr fs:[00000030h]7_2_036B8243
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B8243 mov ecx, dword ptr fs:[00000030h]7_2_036B8243
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0370625D mov eax, dword ptr fs:[00000030h]7_2_0370625D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362A250 mov eax, dword ptr fs:[00000030h]7_2_0362A250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03636259 mov eax, dword ptr fs:[00000030h]7_2_03636259
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036EA250 mov eax, dword ptr fs:[00000030h]7_2_036EA250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036EA250 mov eax, dword ptr fs:[00000030h]7_2_036EA250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362823B mov eax, dword ptr fs:[00000030h]7_2_0362823B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036402E1 mov eax, dword ptr fs:[00000030h]7_2_036402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036402E1 mov eax, dword ptr fs:[00000030h]7_2_036402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036402E1 mov eax, dword ptr fs:[00000030h]7_2_036402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A2C3 mov eax, dword ptr fs:[00000030h]7_2_0363A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A2C3 mov eax, dword ptr fs:[00000030h]7_2_0363A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A2C3 mov eax, dword ptr fs:[00000030h]7_2_0363A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A2C3 mov eax, dword ptr fs:[00000030h]7_2_0363A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A2C3 mov eax, dword ptr fs:[00000030h]7_2_0363A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_037062D6 mov eax, dword ptr fs:[00000030h]7_2_037062D6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036402A0 mov eax, dword ptr fs:[00000030h]7_2_036402A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036402A0 mov eax, dword ptr fs:[00000030h]7_2_036402A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C62A0 mov eax, dword ptr fs:[00000030h]7_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C62A0 mov ecx, dword ptr fs:[00000030h]7_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C62A0 mov eax, dword ptr fs:[00000030h]7_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C62A0 mov eax, dword ptr fs:[00000030h]7_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C62A0 mov eax, dword ptr fs:[00000030h]7_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C62A0 mov eax, dword ptr fs:[00000030h]7_2_036C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E284 mov eax, dword ptr fs:[00000030h]7_2_0366E284
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E284 mov eax, dword ptr fs:[00000030h]7_2_0366E284
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B0283 mov eax, dword ptr fs:[00000030h]7_2_036B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B0283 mov eax, dword ptr fs:[00000030h]7_2_036B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B0283 mov eax, dword ptr fs:[00000030h]7_2_036B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704164 mov eax, dword ptr fs:[00000030h]7_2_03704164
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704164 mov eax, dword ptr fs:[00000030h]7_2_03704164
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C4144 mov eax, dword ptr fs:[00000030h]7_2_036C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C4144 mov eax, dword ptr fs:[00000030h]7_2_036C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C4144 mov ecx, dword ptr fs:[00000030h]7_2_036C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C4144 mov eax, dword ptr fs:[00000030h]7_2_036C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C4144 mov eax, dword ptr fs:[00000030h]7_2_036C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362C156 mov eax, dword ptr fs:[00000030h]7_2_0362C156
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C8158 mov eax, dword ptr fs:[00000030h]7_2_036C8158
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03636154 mov eax, dword ptr fs:[00000030h]7_2_03636154
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03636154 mov eax, dword ptr fs:[00000030h]7_2_03636154
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03660124 mov eax, dword ptr fs:[00000030h]7_2_03660124
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE10E mov eax, dword ptr fs:[00000030h]7_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE10E mov ecx, dword ptr fs:[00000030h]7_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE10E mov eax, dword ptr fs:[00000030h]7_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE10E mov eax, dword ptr fs:[00000030h]7_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE10E mov ecx, dword ptr fs:[00000030h]7_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE10E mov eax, dword ptr fs:[00000030h]7_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE10E mov eax, dword ptr fs:[00000030h]7_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE10E mov ecx, dword ptr fs:[00000030h]7_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE10E mov eax, dword ptr fs:[00000030h]7_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DE10E mov ecx, dword ptr fs:[00000030h]7_2_036DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DA118 mov ecx, dword ptr fs:[00000030h]7_2_036DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DA118 mov eax, dword ptr fs:[00000030h]7_2_036DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DA118 mov eax, dword ptr fs:[00000030h]7_2_036DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DA118 mov eax, dword ptr fs:[00000030h]7_2_036DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F0115 mov eax, dword ptr fs:[00000030h]7_2_036F0115
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_037061E5 mov eax, dword ptr fs:[00000030h]7_2_037061E5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036601F8 mov eax, dword ptr fs:[00000030h]7_2_036601F8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F61C3 mov eax, dword ptr fs:[00000030h]7_2_036F61C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F61C3 mov eax, dword ptr fs:[00000030h]7_2_036F61C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE1D0 mov eax, dword ptr fs:[00000030h]7_2_036AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE1D0 mov eax, dword ptr fs:[00000030h]7_2_036AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE1D0 mov ecx, dword ptr fs:[00000030h]7_2_036AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE1D0 mov eax, dword ptr fs:[00000030h]7_2_036AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE1D0 mov eax, dword ptr fs:[00000030h]7_2_036AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03670185 mov eax, dword ptr fs:[00000030h]7_2_03670185
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036EC188 mov eax, dword ptr fs:[00000030h]7_2_036EC188
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036EC188 mov eax, dword ptr fs:[00000030h]7_2_036EC188
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D4180 mov eax, dword ptr fs:[00000030h]7_2_036D4180
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D4180 mov eax, dword ptr fs:[00000030h]7_2_036D4180
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B019F mov eax, dword ptr fs:[00000030h]7_2_036B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B019F mov eax, dword ptr fs:[00000030h]7_2_036B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B019F mov eax, dword ptr fs:[00000030h]7_2_036B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B019F mov eax, dword ptr fs:[00000030h]7_2_036B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362A197 mov eax, dword ptr fs:[00000030h]7_2_0362A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362A197 mov eax, dword ptr fs:[00000030h]7_2_0362A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362A197 mov eax, dword ptr fs:[00000030h]7_2_0362A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365C073 mov eax, dword ptr fs:[00000030h]7_2_0365C073
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03632050 mov eax, dword ptr fs:[00000030h]7_2_03632050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B6050 mov eax, dword ptr fs:[00000030h]7_2_036B6050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362A020 mov eax, dword ptr fs:[00000030h]7_2_0362A020
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362C020 mov eax, dword ptr fs:[00000030h]7_2_0362C020
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C6030 mov eax, dword ptr fs:[00000030h]7_2_036C6030
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B4000 mov ecx, dword ptr fs:[00000030h]7_2_036B4000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D2000 mov eax, dword ptr fs:[00000030h]7_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D2000 mov eax, dword ptr fs:[00000030h]7_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D2000 mov eax, dword ptr fs:[00000030h]7_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D2000 mov eax, dword ptr fs:[00000030h]7_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D2000 mov eax, dword ptr fs:[00000030h]7_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D2000 mov eax, dword ptr fs:[00000030h]7_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D2000 mov eax, dword ptr fs:[00000030h]7_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D2000 mov eax, dword ptr fs:[00000030h]7_2_036D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364E016 mov eax, dword ptr fs:[00000030h]7_2_0364E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364E016 mov eax, dword ptr fs:[00000030h]7_2_0364E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364E016 mov eax, dword ptr fs:[00000030h]7_2_0364E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364E016 mov eax, dword ptr fs:[00000030h]7_2_0364E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362A0E3 mov ecx, dword ptr fs:[00000030h]7_2_0362A0E3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036380E9 mov eax, dword ptr fs:[00000030h]7_2_036380E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B60E0 mov eax, dword ptr fs:[00000030h]7_2_036B60E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362C0F0 mov eax, dword ptr fs:[00000030h]7_2_0362C0F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036720F0 mov ecx, dword ptr fs:[00000030h]7_2_036720F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B20DE mov eax, dword ptr fs:[00000030h]7_2_036B20DE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036280A0 mov eax, dword ptr fs:[00000030h]7_2_036280A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C80A8 mov eax, dword ptr fs:[00000030h]7_2_036C80A8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F60B8 mov eax, dword ptr fs:[00000030h]7_2_036F60B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F60B8 mov ecx, dword ptr fs:[00000030h]7_2_036F60B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363208A mov eax, dword ptr fs:[00000030h]7_2_0363208A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03638770 mov eax, dword ptr fs:[00000030h]7_2_03638770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640770 mov eax, dword ptr fs:[00000030h]7_2_03640770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366674D mov esi, dword ptr fs:[00000030h]7_2_0366674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366674D mov eax, dword ptr fs:[00000030h]7_2_0366674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366674D mov eax, dword ptr fs:[00000030h]7_2_0366674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03630750 mov eax, dword ptr fs:[00000030h]7_2_03630750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BE75D mov eax, dword ptr fs:[00000030h]7_2_036BE75D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672750 mov eax, dword ptr fs:[00000030h]7_2_03672750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672750 mov eax, dword ptr fs:[00000030h]7_2_03672750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B4755 mov eax, dword ptr fs:[00000030h]7_2_036B4755
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366C720 mov eax, dword ptr fs:[00000030h]7_2_0366C720
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366C720 mov eax, dword ptr fs:[00000030h]7_2_0366C720
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366273C mov eax, dword ptr fs:[00000030h]7_2_0366273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366273C mov ecx, dword ptr fs:[00000030h]7_2_0366273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366273C mov eax, dword ptr fs:[00000030h]7_2_0366273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AC730 mov eax, dword ptr fs:[00000030h]7_2_036AC730
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366C700 mov eax, dword ptr fs:[00000030h]7_2_0366C700
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03630710 mov eax, dword ptr fs:[00000030h]7_2_03630710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03660710 mov eax, dword ptr fs:[00000030h]7_2_03660710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036527ED mov eax, dword ptr fs:[00000030h]7_2_036527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036527ED mov eax, dword ptr fs:[00000030h]7_2_036527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036527ED mov eax, dword ptr fs:[00000030h]7_2_036527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BE7E1 mov eax, dword ptr fs:[00000030h]7_2_036BE7E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036347FB mov eax, dword ptr fs:[00000030h]7_2_036347FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036347FB mov eax, dword ptr fs:[00000030h]7_2_036347FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363C7C0 mov eax, dword ptr fs:[00000030h]7_2_0363C7C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B07C3 mov eax, dword ptr fs:[00000030h]7_2_036B07C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036307AF mov eax, dword ptr fs:[00000030h]7_2_036307AF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E47A0 mov eax, dword ptr fs:[00000030h]7_2_036E47A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D678E mov eax, dword ptr fs:[00000030h]7_2_036D678E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F866E mov eax, dword ptr fs:[00000030h]7_2_036F866E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F866E mov eax, dword ptr fs:[00000030h]7_2_036F866E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366A660 mov eax, dword ptr fs:[00000030h]7_2_0366A660
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366A660 mov eax, dword ptr fs:[00000030h]7_2_0366A660
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03662674 mov eax, dword ptr fs:[00000030h]7_2_03662674
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364C640 mov eax, dword ptr fs:[00000030h]7_2_0364C640
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364E627 mov eax, dword ptr fs:[00000030h]7_2_0364E627
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03666620 mov eax, dword ptr fs:[00000030h]7_2_03666620
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03668620 mov eax, dword ptr fs:[00000030h]7_2_03668620
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363262C mov eax, dword ptr fs:[00000030h]7_2_0363262C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE609 mov eax, dword ptr fs:[00000030h]7_2_036AE609
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364260B mov eax, dword ptr fs:[00000030h]7_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364260B mov eax, dword ptr fs:[00000030h]7_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364260B mov eax, dword ptr fs:[00000030h]7_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364260B mov eax, dword ptr fs:[00000030h]7_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364260B mov eax, dword ptr fs:[00000030h]7_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364260B mov eax, dword ptr fs:[00000030h]7_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0364260B mov eax, dword ptr fs:[00000030h]7_2_0364260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03672619 mov eax, dword ptr fs:[00000030h]7_2_03672619
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE6F2 mov eax, dword ptr fs:[00000030h]7_2_036AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE6F2 mov eax, dword ptr fs:[00000030h]7_2_036AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE6F2 mov eax, dword ptr fs:[00000030h]7_2_036AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE6F2 mov eax, dword ptr fs:[00000030h]7_2_036AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B06F1 mov eax, dword ptr fs:[00000030h]7_2_036B06F1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B06F1 mov eax, dword ptr fs:[00000030h]7_2_036B06F1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366A6C7 mov ebx, dword ptr fs:[00000030h]7_2_0366A6C7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366A6C7 mov eax, dword ptr fs:[00000030h]7_2_0366A6C7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366C6A6 mov eax, dword ptr fs:[00000030h]7_2_0366C6A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036666B0 mov eax, dword ptr fs:[00000030h]7_2_036666B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03634690 mov eax, dword ptr fs:[00000030h]7_2_03634690
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03634690 mov eax, dword ptr fs:[00000030h]7_2_03634690
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366656A mov eax, dword ptr fs:[00000030h]7_2_0366656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366656A mov eax, dword ptr fs:[00000030h]7_2_0366656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366656A mov eax, dword ptr fs:[00000030h]7_2_0366656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03638550 mov eax, dword ptr fs:[00000030h]7_2_03638550
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03638550 mov eax, dword ptr fs:[00000030h]7_2_03638550
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640535 mov eax, dword ptr fs:[00000030h]7_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640535 mov eax, dword ptr fs:[00000030h]7_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640535 mov eax, dword ptr fs:[00000030h]7_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640535 mov eax, dword ptr fs:[00000030h]7_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640535 mov eax, dword ptr fs:[00000030h]7_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640535 mov eax, dword ptr fs:[00000030h]7_2_03640535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E53E mov eax, dword ptr fs:[00000030h]7_2_0365E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E53E mov eax, dword ptr fs:[00000030h]7_2_0365E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E53E mov eax, dword ptr fs:[00000030h]7_2_0365E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E53E mov eax, dword ptr fs:[00000030h]7_2_0365E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E53E mov eax, dword ptr fs:[00000030h]7_2_0365E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C6500 mov eax, dword ptr fs:[00000030h]7_2_036C6500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704500 mov eax, dword ptr fs:[00000030h]7_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704500 mov eax, dword ptr fs:[00000030h]7_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704500 mov eax, dword ptr fs:[00000030h]7_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704500 mov eax, dword ptr fs:[00000030h]7_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704500 mov eax, dword ptr fs:[00000030h]7_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704500 mov eax, dword ptr fs:[00000030h]7_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704500 mov eax, dword ptr fs:[00000030h]7_2_03704500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E5E7 mov eax, dword ptr fs:[00000030h]7_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E5E7 mov eax, dword ptr fs:[00000030h]7_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E5E7 mov eax, dword ptr fs:[00000030h]7_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E5E7 mov eax, dword ptr fs:[00000030h]7_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E5E7 mov eax, dword ptr fs:[00000030h]7_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E5E7 mov eax, dword ptr fs:[00000030h]7_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E5E7 mov eax, dword ptr fs:[00000030h]7_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365E5E7 mov eax, dword ptr fs:[00000030h]7_2_0365E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036325E0 mov eax, dword ptr fs:[00000030h]7_2_036325E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366C5ED mov eax, dword ptr fs:[00000030h]7_2_0366C5ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366C5ED mov eax, dword ptr fs:[00000030h]7_2_0366C5ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E5CF mov eax, dword ptr fs:[00000030h]7_2_0366E5CF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E5CF mov eax, dword ptr fs:[00000030h]7_2_0366E5CF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036365D0 mov eax, dword ptr fs:[00000030h]7_2_036365D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366A5D0 mov eax, dword ptr fs:[00000030h]7_2_0366A5D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366A5D0 mov eax, dword ptr fs:[00000030h]7_2_0366A5D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B05A7 mov eax, dword ptr fs:[00000030h]7_2_036B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B05A7 mov eax, dword ptr fs:[00000030h]7_2_036B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B05A7 mov eax, dword ptr fs:[00000030h]7_2_036B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036545B1 mov eax, dword ptr fs:[00000030h]7_2_036545B1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036545B1 mov eax, dword ptr fs:[00000030h]7_2_036545B1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03632582 mov eax, dword ptr fs:[00000030h]7_2_03632582
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03632582 mov ecx, dword ptr fs:[00000030h]7_2_03632582
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03664588 mov eax, dword ptr fs:[00000030h]7_2_03664588
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E59C mov eax, dword ptr fs:[00000030h]7_2_0366E59C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BC460 mov ecx, dword ptr fs:[00000030h]7_2_036BC460
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365A470 mov eax, dword ptr fs:[00000030h]7_2_0365A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365A470 mov eax, dword ptr fs:[00000030h]7_2_0365A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365A470 mov eax, dword ptr fs:[00000030h]7_2_0365A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E443 mov eax, dword ptr fs:[00000030h]7_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E443 mov eax, dword ptr fs:[00000030h]7_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E443 mov eax, dword ptr fs:[00000030h]7_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E443 mov eax, dword ptr fs:[00000030h]7_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E443 mov eax, dword ptr fs:[00000030h]7_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E443 mov eax, dword ptr fs:[00000030h]7_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E443 mov eax, dword ptr fs:[00000030h]7_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366E443 mov eax, dword ptr fs:[00000030h]7_2_0366E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036EA456 mov eax, dword ptr fs:[00000030h]7_2_036EA456
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362645D mov eax, dword ptr fs:[00000030h]7_2_0362645D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365245A mov eax, dword ptr fs:[00000030h]7_2_0365245A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362E420 mov eax, dword ptr fs:[00000030h]7_2_0362E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362E420 mov eax, dword ptr fs:[00000030h]7_2_0362E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362E420 mov eax, dword ptr fs:[00000030h]7_2_0362E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362C427 mov eax, dword ptr fs:[00000030h]7_2_0362C427
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B6420 mov eax, dword ptr fs:[00000030h]7_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B6420 mov eax, dword ptr fs:[00000030h]7_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B6420 mov eax, dword ptr fs:[00000030h]7_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B6420 mov eax, dword ptr fs:[00000030h]7_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B6420 mov eax, dword ptr fs:[00000030h]7_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B6420 mov eax, dword ptr fs:[00000030h]7_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B6420 mov eax, dword ptr fs:[00000030h]7_2_036B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366A430 mov eax, dword ptr fs:[00000030h]7_2_0366A430
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03668402 mov eax, dword ptr fs:[00000030h]7_2_03668402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03668402 mov eax, dword ptr fs:[00000030h]7_2_03668402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03668402 mov eax, dword ptr fs:[00000030h]7_2_03668402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036304E5 mov ecx, dword ptr fs:[00000030h]7_2_036304E5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036364AB mov eax, dword ptr fs:[00000030h]7_2_036364AB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036644B0 mov ecx, dword ptr fs:[00000030h]7_2_036644B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BA4B0 mov eax, dword ptr fs:[00000030h]7_2_036BA4B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036EA49A mov eax, dword ptr fs:[00000030h]7_2_036EA49A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0362CB7E mov eax, dword ptr fs:[00000030h]7_2_0362CB7E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E4B4B mov eax, dword ptr fs:[00000030h]7_2_036E4B4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E4B4B mov eax, dword ptr fs:[00000030h]7_2_036E4B4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03702B57 mov eax, dword ptr fs:[00000030h]7_2_03702B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03702B57 mov eax, dword ptr fs:[00000030h]7_2_03702B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03702B57 mov eax, dword ptr fs:[00000030h]7_2_03702B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03702B57 mov eax, dword ptr fs:[00000030h]7_2_03702B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C6B40 mov eax, dword ptr fs:[00000030h]7_2_036C6B40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C6B40 mov eax, dword ptr fs:[00000030h]7_2_036C6B40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FAB40 mov eax, dword ptr fs:[00000030h]7_2_036FAB40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D8B42 mov eax, dword ptr fs:[00000030h]7_2_036D8B42
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03628B50 mov eax, dword ptr fs:[00000030h]7_2_03628B50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DEB50 mov eax, dword ptr fs:[00000030h]7_2_036DEB50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365EB20 mov eax, dword ptr fs:[00000030h]7_2_0365EB20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365EB20 mov eax, dword ptr fs:[00000030h]7_2_0365EB20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F8B28 mov eax, dword ptr fs:[00000030h]7_2_036F8B28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036F8B28 mov eax, dword ptr fs:[00000030h]7_2_036F8B28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704B00 mov eax, dword ptr fs:[00000030h]7_2_03704B00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AEB1D mov eax, dword ptr fs:[00000030h]7_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AEB1D mov eax, dword ptr fs:[00000030h]7_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AEB1D mov eax, dword ptr fs:[00000030h]7_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AEB1D mov eax, dword ptr fs:[00000030h]7_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AEB1D mov eax, dword ptr fs:[00000030h]7_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AEB1D mov eax, dword ptr fs:[00000030h]7_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AEB1D mov eax, dword ptr fs:[00000030h]7_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AEB1D mov eax, dword ptr fs:[00000030h]7_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AEB1D mov eax, dword ptr fs:[00000030h]7_2_036AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03638BF0 mov eax, dword ptr fs:[00000030h]7_2_03638BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03638BF0 mov eax, dword ptr fs:[00000030h]7_2_03638BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03638BF0 mov eax, dword ptr fs:[00000030h]7_2_03638BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365EBFC mov eax, dword ptr fs:[00000030h]7_2_0365EBFC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BCBF0 mov eax, dword ptr fs:[00000030h]7_2_036BCBF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03650BCB mov eax, dword ptr fs:[00000030h]7_2_03650BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03650BCB mov eax, dword ptr fs:[00000030h]7_2_03650BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03650BCB mov eax, dword ptr fs:[00000030h]7_2_03650BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03630BCD mov eax, dword ptr fs:[00000030h]7_2_03630BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03630BCD mov eax, dword ptr fs:[00000030h]7_2_03630BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03630BCD mov eax, dword ptr fs:[00000030h]7_2_03630BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DEBD0 mov eax, dword ptr fs:[00000030h]7_2_036DEBD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640BBE mov eax, dword ptr fs:[00000030h]7_2_03640BBE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640BBE mov eax, dword ptr fs:[00000030h]7_2_03640BBE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E4BB0 mov eax, dword ptr fs:[00000030h]7_2_036E4BB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036E4BB0 mov eax, dword ptr fs:[00000030h]7_2_036E4BB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366CA6F mov eax, dword ptr fs:[00000030h]7_2_0366CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366CA6F mov eax, dword ptr fs:[00000030h]7_2_0366CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366CA6F mov eax, dword ptr fs:[00000030h]7_2_0366CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036DEA60 mov eax, dword ptr fs:[00000030h]7_2_036DEA60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036ACA72 mov eax, dword ptr fs:[00000030h]7_2_036ACA72
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036ACA72 mov eax, dword ptr fs:[00000030h]7_2_036ACA72
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03636A50 mov eax, dword ptr fs:[00000030h]7_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03636A50 mov eax, dword ptr fs:[00000030h]7_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03636A50 mov eax, dword ptr fs:[00000030h]7_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03636A50 mov eax, dword ptr fs:[00000030h]7_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03636A50 mov eax, dword ptr fs:[00000030h]7_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03636A50 mov eax, dword ptr fs:[00000030h]7_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03636A50 mov eax, dword ptr fs:[00000030h]7_2_03636A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640A5B mov eax, dword ptr fs:[00000030h]7_2_03640A5B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03640A5B mov eax, dword ptr fs:[00000030h]7_2_03640A5B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366CA24 mov eax, dword ptr fs:[00000030h]7_2_0366CA24
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0365EA2E mov eax, dword ptr fs:[00000030h]7_2_0365EA2E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03654A35 mov eax, dword ptr fs:[00000030h]7_2_03654A35
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03654A35 mov eax, dword ptr fs:[00000030h]7_2_03654A35
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366CA38 mov eax, dword ptr fs:[00000030h]7_2_0366CA38
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BCA11 mov eax, dword ptr fs:[00000030h]7_2_036BCA11
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366AAEE mov eax, dword ptr fs:[00000030h]7_2_0366AAEE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0366AAEE mov eax, dword ptr fs:[00000030h]7_2_0366AAEE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03686ACC mov eax, dword ptr fs:[00000030h]7_2_03686ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03686ACC mov eax, dword ptr fs:[00000030h]7_2_03686ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03686ACC mov eax, dword ptr fs:[00000030h]7_2_03686ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03630AD0 mov eax, dword ptr fs:[00000030h]7_2_03630AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03664AD0 mov eax, dword ptr fs:[00000030h]7_2_03664AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03664AD0 mov eax, dword ptr fs:[00000030h]7_2_03664AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03638AA0 mov eax, dword ptr fs:[00000030h]7_2_03638AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03638AA0 mov eax, dword ptr fs:[00000030h]7_2_03638AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03686AA4 mov eax, dword ptr fs:[00000030h]7_2_03686AA4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363EA80 mov eax, dword ptr fs:[00000030h]7_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363EA80 mov eax, dword ptr fs:[00000030h]7_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363EA80 mov eax, dword ptr fs:[00000030h]7_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363EA80 mov eax, dword ptr fs:[00000030h]7_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363EA80 mov eax, dword ptr fs:[00000030h]7_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363EA80 mov eax, dword ptr fs:[00000030h]7_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363EA80 mov eax, dword ptr fs:[00000030h]7_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363EA80 mov eax, dword ptr fs:[00000030h]7_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363EA80 mov eax, dword ptr fs:[00000030h]7_2_0363EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704A80 mov eax, dword ptr fs:[00000030h]7_2_03704A80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03668A90 mov edx, dword ptr fs:[00000030h]7_2_03668A90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03656962 mov eax, dword ptr fs:[00000030h]7_2_03656962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03656962 mov eax, dword ptr fs:[00000030h]7_2_03656962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03656962 mov eax, dword ptr fs:[00000030h]7_2_03656962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0367096E mov eax, dword ptr fs:[00000030h]7_2_0367096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0367096E mov edx, dword ptr fs:[00000030h]7_2_0367096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0367096E mov eax, dword ptr fs:[00000030h]7_2_0367096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D4978 mov eax, dword ptr fs:[00000030h]7_2_036D4978
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036D4978 mov eax, dword ptr fs:[00000030h]7_2_036D4978
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BC97C mov eax, dword ptr fs:[00000030h]7_2_036BC97C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B0946 mov eax, dword ptr fs:[00000030h]7_2_036B0946
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03704940 mov eax, dword ptr fs:[00000030h]7_2_03704940
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B892A mov eax, dword ptr fs:[00000030h]7_2_036B892A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C892B mov eax, dword ptr fs:[00000030h]7_2_036C892B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE908 mov eax, dword ptr fs:[00000030h]7_2_036AE908
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036AE908 mov eax, dword ptr fs:[00000030h]7_2_036AE908
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BC912 mov eax, dword ptr fs:[00000030h]7_2_036BC912
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03628918 mov eax, dword ptr fs:[00000030h]7_2_03628918
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03628918 mov eax, dword ptr fs:[00000030h]7_2_03628918
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BE9E0 mov eax, dword ptr fs:[00000030h]7_2_036BE9E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036629F9 mov eax, dword ptr fs:[00000030h]7_2_036629F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036629F9 mov eax, dword ptr fs:[00000030h]7_2_036629F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C69C0 mov eax, dword ptr fs:[00000030h]7_2_036C69C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A9D0 mov eax, dword ptr fs:[00000030h]7_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A9D0 mov eax, dword ptr fs:[00000030h]7_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A9D0 mov eax, dword ptr fs:[00000030h]7_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A9D0 mov eax, dword ptr fs:[00000030h]7_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A9D0 mov eax, dword ptr fs:[00000030h]7_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0363A9D0 mov eax, dword ptr fs:[00000030h]7_2_0363A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036649D0 mov eax, dword ptr fs:[00000030h]7_2_036649D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036FA9D3 mov eax, dword ptr fs:[00000030h]7_2_036FA9D3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036429A0 mov eax, dword ptr fs:[00000030h]7_2_036429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036309AD mov eax, dword ptr fs:[00000030h]7_2_036309AD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036309AD mov eax, dword ptr fs:[00000030h]7_2_036309AD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B89B3 mov esi, dword ptr fs:[00000030h]7_2_036B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B89B3 mov eax, dword ptr fs:[00000030h]7_2_036B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036B89B3 mov eax, dword ptr fs:[00000030h]7_2_036B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BE872 mov eax, dword ptr fs:[00000030h]7_2_036BE872
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036BE872 mov eax, dword ptr fs:[00000030h]7_2_036BE872
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C6870 mov eax, dword ptr fs:[00000030h]7_2_036C6870
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_036C6870 mov eax, dword ptr fs:[00000030h]7_2_036C6870
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03642840 mov ecx, dword ptr fs:[00000030h]7_2_03642840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03660854 mov eax, dword ptr fs:[00000030h]7_2_03660854
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03634859 mov eax, dword ptr fs:[00000030h]7_2_03634859
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03634859 mov eax, dword ptr fs:[00000030h]7_2_03634859
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03652835 mov eax, dword ptr fs:[00000030h]7_2_03652835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03652835 mov eax, dword ptr fs:[00000030h]7_2_03652835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03652835 mov eax, dword ptr fs:[00000030h]7_2_03652835
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003FA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,4_2_003FA66C
          Source: C:\Windows\SysWOW64\svchost.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003E81AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_003E81AC
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003E8189 SetUnhandledExceptionFilter,4_2_003E8189

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\help.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\help.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\help.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\help.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Windows\SysWOW64\svchost.exeThread register set: target process: 4056Jump to behavior
          Source: C:\Windows\SysWOW64\help.exeThread register set: target process: 4056Jump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Windows\SysWOW64\svchost.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Windows\SysWOW64\svchost.exeSection unmapped: C:\Windows\SysWOW64\help.exe base address: 9C0000Jump to behavior
          Writes to foreign memory regions
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2D56008Jump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003FB106 LogonUserW,4_2_003FB106
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003C3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,4_2_003C3D19
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0040411C SendInput,keybd_event,4_2_0040411C
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_004074E7 mouse_event,4_2_004074E7
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\help.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"Jump to behavior
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003FA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,4_2_003FA66C
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_004071FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,4_2_004071FA
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exe, explorer.exe, 00000008.00000002.2546865456.0000000004880000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2544282984.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000008.00000002.2544282984.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.1307462104.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000008.00000002.2544282984.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.1307462104.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
          Source: explorer.exe, 00000008.00000002.2542950817.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1307008242.0000000000C59000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
          Source: explorer.exe, 00000008.00000002.2544282984.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.1307462104.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003E65C4 cpuid 4_2_003E65C4
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0041091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,4_2_0041091D
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0043B340 GetUserNameW,4_2_0043B340
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003F1E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,4_2_003F1E8E
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_003DDDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,4_2_003DDDC0

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeBinary or memory string: WIN_81
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeBinary or memory string: WIN_XP
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeBinary or memory string: WIN_XPe
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeBinary or memory string: WIN_VISTA
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeBinary or memory string: WIN_7
          Source: brief nr. 001150_51_2024-11-19_134943.docx.exeBinary or memory string: WIN_8

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.brief nr. 001150_51_2024-11-19_134943.docx.exe.3a90000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_00418C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,4_2_00418C4F
          Source: C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exeCode function: 4_2_0041923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,4_2_0041923B

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire Infrastructure2
          Valid Accounts          		2
          Windows Management Instrumentation          		1
          DLL Side-Loading          		1
          Exploitation for Privilege Escalation          		1
          Disable or Modify Tools          		1
          Credential API Hooking          		2
          System Time Discovery          		Remote Services1
          Archive Collected Data          		1
          Ingress Tool Transfer          		Exfiltration Over Other Network Medium1
          System Shutdown/Reboot
          CredentialsDomainsDefault Accounts2
          Native API          		2
          Valid Accounts          		1
          DLL Side-Loading          		1
          Deobfuscate/Decode Files or Information          		11
          Input Capture          		1
          Account Discovery          		Remote Desktop Protocol1
          Credential API Hooking          		1
          Encrypted Channel          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain Accounts1
          Shared Modules          		Logon Script (Windows)2
          Valid Accounts          		3
          Obfuscated Files or Information          		Security Account Manager2
          File and Directory Discovery          		SMB/Windows Admin Shares11
          Input Capture          		1
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
          Access Token Manipulation          		1
          DLL Side-Loading          		NTDS235
          System Information Discovery          		Distributed Component Object Model3
          Clipboard Data          		11
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script512
          Process Injection          		1
          Rootkit          		LSA Secrets261
          Security Software Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
          Valid Accounts          		Cached Domain Credentials3
          Virtualization/Sandbox Evasion          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items3
          Virtualization/Sandbox Evasion          		DCSync3
          Process Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
          Access Token Manipulation          		Proc Filesystem11
          Application Window Discovery          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt512
          Process Injection          		/etc/passwd and /etc/shadow1
          System Owner/User Discovery          		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1562319 Sample: brief nr. 001150_51_2024-11... Startdate: 25/11/2024 Architecture: WINDOWS Score: 100 26 www.unluoren.top 2->26 28 www.narchists.info 2->28 30 3 other IPs or domains 2->30 32 Found malware configuration 2->32 34 Malicious sample detected (through community Yara rule) 2->34 36 Antivirus detection for URL or domain 2->36 38 9 other signatures 2->38 11 brief nr. 001150_51_2024-11-19_134943.docx.exe 2 2->11         started        signatures3 process4 signatures5 48 Binary is likely a compiled AutoIt script file 11->48 50 Writes to foreign memory regions 11->50 52 Maps a DLL or memory area into another process 11->52 14 svchost.exe 11->14         started        process6 signatures7 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Sample uses process hollowing technique 14->58 60 3 other signatures 14->60 17 explorer.exe 34 1 14->17 injected process8 process9 19 help.exe 17->19         started        signatures10 40 Modifies the context of a thread in another process (thread injection) 19->40 42 Maps a DLL or memory area into another process 19->42 44 Tries to detect virtualization through RDTSC time measurements 19->44 46 Switches to a custom stack to bypass stack traces 19->46 22 cmd.exe 1 19->22         started        process11 process12 24 conhost.exe 22->24         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          brief nr. 001150_51_2024-11-19_134943.docx.exe61%ReversingLabsWin32.Trojan.AutoitInject
          brief nr. 001150_51_2024-11-19_134943.docx.exe100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.ec.baby/ud04/www.2creativedesign.online0%Avira URL Cloudsafe
          www.2creativedesign.online/ud04/0%Avira URL Cloudsafe
          http://www.narchists.info0%Avira URL Cloudsafe
          http://www.el-radu-easy4y.one/ud04/www.asik-eye-surgery-63293.bond0%Avira URL Cloudsafe
          http://www.iuxy.host/ud04/www.df.clinic0%Avira URL Cloudsafe
          http://www.narchists.info/ud04/www.ec.baby0%Avira URL Cloudsafe
          http://www.2creativedesign.online/ud04/0%Avira URL Cloudsafe
          http://www.gzvmt.info/ud04/0%Avira URL Cloudsafe
          http://www.ec.baby0%Avira URL Cloudsafe
          http://www.narchists.info/ud04/0%Avira URL Cloudsafe
          http://www.uy-now-pay-later-74776.bond/ud04/0%Avira URL Cloudsafe
          http://www.df.clinic0%Avira URL Cloudsafe
          http://www.lranchomx.xyz/ud04/www.1130.vip0%Avira URL Cloudsafe
          http://www.akrzus.pro0%Avira URL Cloudsafe
          http://www.unluoren.top0%Avira URL Cloudsafe
          http://www.lranchomx.xyz/ud04/0%Avira URL Cloudsafe
          http://www.uy-now-pay-later-74776.bond/ud04/www.akrzus.pro0%Avira URL Cloudsafe
          http://www.uy-now-pay-later-74776.bondReferer:0%Avira URL Cloudsafe
          http://www.ybzert.online/ud04/0%Avira URL Cloudsafe
          http://www.uy-now-pay-later-74776.bond0%Avira URL Cloudsafe
          http://www.1130.vip/ud04/www.el-radu-easy4y.one0%Avira URL Cloudsafe
          http://www.lranchomx.xyz0%Avira URL Cloudsafe
          http://www.akrzus.pro/ud04/www.gzvmt.info0%Avira URL Cloudsafe
          http://www.df.clinicReferer:0%Avira URL Cloudsafe
          http://www.asik-eye-surgery-63293.bondReferer:0%Avira URL Cloudsafe
          http://www.akrzus.proReferer:0%Avira URL Cloudsafe
          http://www.edcn.link0%Avira URL Cloudsafe
          http://www.edcn.link/ud04/www.ybzert.online0%Avira URL Cloudsafe
          http://www.unluoren.top/ud04/www.narchists.info0%Avira URL Cloudsafe
          http://www.1130.vip0%Avira URL Cloudsafe
          http://www.df.clinic/ud04/0%Avira URL Cloudsafe
          http://www.gzvmt.info/ud04/P0%Avira URL Cloudsafe
          http://www.1130.vip/ud04/0%Avira URL Cloudsafe
          http://www.rofilern.net0%Avira URL Cloudsafe
          http://www.iuxy.hostReferer:0%Avira URL Cloudsafe
          http://www.lranchomx.xyzReferer:0%Avira URL Cloudsafe
          http://www.ybzert.online/ud04/www.iuxy.host100%Avira URL Cloudmalware
          http://www.2creativedesign.online/ud04/www.edcn.link0%Avira URL Cloudsafe
          http://www.asik-eye-surgery-63293.bond0%Avira URL Cloudsafe
          http://www.unluoren.top/ud04/0%Avira URL Cloudsafe
          http://www.unluoren.topReferer:0%Avira URL Cloudsafe
          http://www.el-radu-easy4y.one0%Avira URL Cloudsafe
          http://www.2creativedesign.online0%Avira URL Cloudsafe
          http://www.2creativedesign.onlineReferer:0%Avira URL Cloudsafe
          http://www.el-radu-easy4y.one/ud04/0%Avira URL Cloudsafe
          http://www.gzvmt.infoReferer:0%Avira URL Cloudsafe
          http://www.akrzus.pro/ud04/0%Avira URL Cloudsafe
          http://www.iuxy.host/ud04/0%Avira URL Cloudsafe
          http://www.asik-eye-surgery-63293.bond/ud04/0%Avira URL Cloudsafe
          http://www.rofilern.netReferer:0%Avira URL Cloudsafe
          http://www.df.clinic/ud04/www.lranchomx.xyz0%Avira URL Cloudsafe
          http://www.edcn.linkReferer:0%Avira URL Cloudsafe
          http://www.asik-eye-surgery-63293.bond/ud04/www.rofilern.net0%Avira URL Cloudsafe
          http://www.iuxy.host0%Avira URL Cloudsafe
          http://www.edcn.link/ud04/0%Avira URL Cloudsafe
          http://www.narchists.infoReferer:0%Avira URL Cloudsafe
          http://www.ec.babyReferer:0%Avira URL Cloudsafe
          http://www.rofilern.net/ud04/www.uy-now-pay-later-74776.bond0%Avira URL Cloudsafe
          http://www.1130.vipReferer:0%Avira URL Cloudsafe
          http://www.rofilern.net/ud04/0%Avira URL Cloudsafe
          http://www.el-radu-easy4y.oneReferer:0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.unluoren.top
          		unknown
          		unknowntrue
            		unknown
            www.ec.baby
            		unknown
            		unknowntrue
              		unknown
              www.edcn.link
              		unknown
              		unknowntrue
                		unknown
                www.narchists.info
                		unknown
                		unknowntrue
                  		unknown
                  www.2creativedesign.online
                  		unknown
                  		unknowntrue
                    		unknown

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    www.2creativedesign.online/ud04/true
                    • Avira URL Cloud: safe
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://www.el-radu-easy4y.one/ud04/www.asik-eye-surgery-63293.bondexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.ec.baby/ud04/www.2creativedesign.onlineexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.narchists.info/ud04/www.ec.babyexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.2creativedesign.online/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://api.msn.com:443/v1/news/Feed/Windows?texplorer.exe, 00000008.00000002.2547244184.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.0000000007276000.00000004.00000001.00020000.00000000.sdmpfalse
                      		high
                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                        		high
                        http://www.iuxy.host/ud04/www.df.clinicexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-worldexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                          		high
                          https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                            		high
                            https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winterexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                              		high
                              http://www.ec.babyexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.narchists.infoexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://excel.office.comexplorer.exe, 00000008.00000000.1317036232.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2558094598.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                		high
                                https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.gzvmt.info/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.narchists.info/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.uy-now-pay-later-74776.bond/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.lranchomx.xyz/ud04/www.1130.vipexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.akrzus.proexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.unluoren.topexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.df.clinicexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&ocexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.uy-now-pay-later-74776.bondexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://wns.windows.com/explorer.exe, 00000008.00000002.2553898092.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1313732014.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.00000000090F2000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.ybzert.online/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.uy-now-pay-later-74776.bondReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.lranchomx.xyz/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.autoitscript.com/autoit3/Jexplorer.exe, 00000008.00000003.2272193145.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271217508.000000000C41F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1317036232.000000000C3F7000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.uy-now-pay-later-74776.bond/ud04/www.akrzus.proexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.lranchomx.xyzexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.1130.vip/ud04/www.el-radu-easy4y.oneexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://word.office.comexplorer.exe, 00000008.00000000.1317036232.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2558094598.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.ybzert.onlineexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high
                                            https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.akrzus.pro/ud04/www.gzvmt.infoexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.df.clinicReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-darkexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://outlook.comexplorer.exe, 00000008.00000000.1317036232.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2558094598.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.1130.vipexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.edcn.linkexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://android.notify.windows.com/iOSexplorer.exe, 00000008.00000003.2271278788.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1313732014.000000000913F000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 00000008.00000000.1313732014.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2553898092.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.asik-eye-surgery-63293.bondReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.edcn.link/ud04/www.ybzert.onlineexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.akrzus.proReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.unluoren.top/ud04/www.narchists.infoexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.2creativedesign.online/ud04/www.edcn.linkexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.df.clinic/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 00000008.00000000.1313732014.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271278788.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2553898092.0000000008F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actuaexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaTexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://www.pollensense.com/explorer.exe, 00000008.00000002.2547244184.00000000071A4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.ybzert.onlineReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://www.gzvmt.info/ud04/Pexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.1130.vip/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.asik-eye-surgery-63293.bondexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.rofilern.netexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/viexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://www.ybzert.online/ud04/www.iuxy.hostexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: malware
                                                                      		unknown
                                                                      https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-bexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://schemas.microexplorer.exe, 00000008.00000002.2552467444.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000003.2273196874.000000000C123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1317036232.000000000C10B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2550734202.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.1312390710.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000002.2558687782.000000000C124000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://www.iuxy.hostReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINtexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.lranchomx.xyzReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.unluoren.top/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-explorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.unluoren.topReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-itexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.2creativedesign.onlineexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.el-radu-easy4y.oneexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.2creativedesign.onlineReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.el-radu-easy4y.one/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsmexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.gzvmt.infoReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    http://www.akrzus.pro/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    http://www.asik-eye-surgery-63293.bond/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    http://www.iuxy.host/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    http://schemas.microsoft.explorer.exe, 00000008.00000003.2273196874.000000000C123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1317036232.000000000C10B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2558687782.000000000C124000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svgexplorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://powerpoint.office.comexplorer.exe, 00000008.00000000.1317036232.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2558094598.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.foreca.comexplorer.exe, 00000008.00000002.2547244184.00000000071A4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.rofilern.netReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://www.df.clinic/ud04/www.lranchomx.xyzexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://www.iuxy.hostexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://www.edcn.link/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://www.edcn.linkReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://www.asik-eye-surgery-63293.bond/ud04/www.rofilern.netexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://www.narchists.infoReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://www.ec.babyReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://www.rofilern.net/ud04/www.uy-now-pay-later-74776.bondexplorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            http://www.1130.vipReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://api.msn.com/explorer.exe, 00000008.00000002.2553898092.0000000008F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.el-radu-easy4y.oneReferer:explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://www.rofilern.net/ud04/explorer.exe, 00000008.00000003.2271251503.000000000C54B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.2559597832.000000000C54E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.2271013980.000000000C46C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-darkexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://www.msn.com:443/en-us/feedexplorer.exe, 00000008.00000002.2547244184.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.1308885201.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		high

                                                                                                  World Map of Contacted IPs

                                                                                                  ⊘No contacted IP infos

                                                                                                  General Information

                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                  Analysis ID:1562319
                                                                                                  Start date and time:2024-11-25 13:57:59 +01:00
                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                  Overall analysis duration:0h 8m 33s
                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                  Report type:full
                                                                                                  Cookbook file name:default.jbs
                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                  Number of analysed new started processes analysed:16
                                                                                                  Number of new started drivers analysed:0
                                                                                                  Number of existing processes analysed:0
                                                                                                  Number of existing drivers analysed:0
                                                                                                  Number of injected processes analysed:1
                                                                                                  Technologies:
                                                                                                  • HCA enabled
                                                                                                  • EGA enabled
                                                                                                  • AMSI enabled
                                                                                                  Analysis Mode:default
                                                                                                  Analysis stop reason:Timeout
                                                                                                  Sample name:brief nr. 001150_51_2024-11-19_134943.docx.exe
                                                                                                  Detection:MAL
                                                                                                  Classification:mal100.troj.evad.winEXE@8/2@5/0
                                                                                                  EGA Information:
                                                                                                  • Successful, ratio: 100%
                                                                                                  HCA Information:
                                                                                                  • Successful, ratio: 100%
                                                                                                  • Number of executed functions: 59
                                                                                                  • Number of non-executed functions: 290
                                                                                                  Cookbook Comments:
                                                                                                  • Found application associated with file extension: .exe

                                                                                                  Warnings

                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                                  • Excluded IPs from analysis (whitelisted): 20.109.210.53, 93.184.221.240, 13.85.23.206
                                                                                                  • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, time.windows.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                  • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                  • VT rate limit hit for: brief nr. 001150_51_2024-11-19_134943.docx.exe

                                                                                                  Simulations

                                                                                                  Behavior and APIs

                                                                                                  TimeTypeDescription
                                                                                                  07:59:00API Interceptor1523575x Sleep call for process: explorer.exe modified
                                                                                                  09:10:01API Interceptor1765214x Sleep call for process: help.exe modified

                                                                                                  Joe Sandbox View / Context

                                                                                                  IPs

                                                                                                  ⊘No context

                                                                                                  Domains

                                                                                                  ⊘No context

                                                                                                  ASNs

                                                                                                  ⊘No context

                                                                                                  JA3 Fingerprints

                                                                                                  ⊘No context

                                                                                                  Dropped Files

                                                                                                  ⊘No context

                                                                                                  Created / dropped Files

                                                                                                  C:\Users\user\AppData\Local\Temp\aut4CA8.tmp

                                                                                                  Download File
                                                                                                  Process:C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe
                                                                                                  File Type:data
                                                                                                  Category:dropped
                                                                                                  Size (bytes):185462
                                                                                                  Entropy (8bit):7.985426877368144
                                                                                                  Encrypted:false
                                                                                                  SSDEEP:3072:ukT61u9YnXfrmBRv784McKAJnr4NkXCXZ81bd8Ya2IOWnlIXJO93VID:uw65Xfr2oDAJnr4NXp8UaYnqrD
                                                                                                  MD5:37DF6E0B75EDF58C4E933D06C02C6ABC
                                                                                                  SHA1:702340DEEAD44969FBBD8F6E2A566C10D76D592C
                                                                                                  SHA-256:205ED881134C8F83F6FC7E2C70C3BA20DF83E2030A14C96A57D988EF31838829
                                                                                                  SHA-512:5ADDF529F98C5B6F8178EC288E222B62E934979F2B273F97F7DE2D8661CB5C5E42BFDE9DF947F91306464C690315411702594E33E810D1D6FCD941A812B82E16
                                                                                                  Malicious:false
                                                                                                  Reputation:low
                                                                                                  Preview:EA06......aP~...H.Z6.J7?5...S.>....L...w.h.4.&..}..Q..3.%..8.L).:}T.i.......9.N?._.:..ri4Rc+..hUY..O3...X..Eo.Ok..T..p.B..:.BSa...q......mN..R.m...Oo.)..?O.c[".n...N..).p(:/..[R..e...[.W.A|4..O.G....._....k.A..h...2....[s.O.......lC.*...2.Q.S.H..1...:...4+....L!.*}VIA................=.....Vj$.w;..'......4`.u......L&..... .k...................p.........n....w/.n.t..z.M...|.6...WvY.}...L".8?.Q<.].Y...w...+.{M_..S0.......j.t..'Y.....].fe..a....K...0..%+_...&\.0.....8]e_a..qs\x.....q...>Z...s}..J...Pgx.g.K>.n6.......t..m/:aK..fxo.....O.}8.'..q..?.E.qq.......7......Q8...fe..H9..6.#?.B.yN.&.....v.[...-.6.......<....c.3:>....~63..r...Rh.....x.......-...v0)..;..J8..O....U..i..[G..+..T....k.....).....?....2.~[..n#.,v.y..bt..W./B.@g}+..?.........L........,9..sqv.s.3....w..^.7}...8......q9.-.....8..].....h.Z(....x..:..y'...I.*.....x.......F......V..J..v.._2u...(_;w..n.........d.h.....a.Y........[=&.7S.ne...o.m.ct..'k....#.Ld.u.t..H-....@lt.%^....l

                                                                                                  C:\Users\user\AppData\Local\Temp\togging

                                                                                                  Download File
                                                                                                  Process:C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe
                                                                                                  File Type:data
                                                                                                  Category:modified
                                                                                                  Size (bytes):189440
                                                                                                  Entropy (8bit):7.8634266639909045
                                                                                                  Encrypted:false
                                                                                                  SSDEEP:3072:83VnjI1IQD3uSB5Xl7MEZv4RQ0qVNsSZblSpJvbJxiphO:2UaQKS/Xl7lZvwWXsMblSpFOo
                                                                                                  MD5:3A8D7E09CF0239985E8C767906FBE861
                                                                                                  SHA1:7AD2B213234CA4FA8A36B1706813A0CE048C2052
                                                                                                  SHA-256:FB14324361968AC9D21A0DAE8D952208B028A36ACFD430CD234ACF15F8376005
                                                                                                  SHA-512:3F715DBF534E583C6D87A5ACC37520E592F4116BAE4D31463E57FE465B0DCDEEB024B06C1DAEAD53D59B135CEE7AEC50EF537D492B49A187B73D7BB7145E5F00
                                                                                                  Malicious:false
                                                                                                  Reputation:low
                                                                                                  Preview:.....AYHNh..F...f.0G...`3F...4AYHN04LODRQ9Z10DGO8H0NCOU4AYH.04LA[._9.8.e.Nt...+&&.1+')BU!o'3?W5E.&"oJ=^n*!up..h#_P)aI_[.Z10DGO8..F...R...(...)..Q.."..8....)..A..R..-19..W.DGO8H0NCOU4AYHN0d.OD.P8Z./.yO8H0NCOU.A[IE1>LO.PQ9Z10DGO8H.OCOE4AY.L04L.DRA9Z12DGJ8I0NCOU1AXHN04LO.PQ9X10DGO8J0..OU$AYXN04L_DRA9Z10DG_8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8fD+;;U4A=.L04\ODR.;Z1 DGO8H0NCOU4AYHn04,ODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04LODRQ9Z10DGO8H0NCOU4AYHN04L

                                                                                                  Static File Info

                                                                                                  General

                                                                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                  Entropy (8bit):7.02276036830393
                                                                                                  TrID:
                                                                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                  • DOS Executable Generic (2002/1) 0.02%
                                                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                  File name:brief nr. 001150_51_2024-11-19_134943.docx.exe
                                                                                                  File size:1'111'552 bytes
                                                                                                  MD5:b333b741b51e1fa861d44c2846939182
                                                                                                  SHA1:1fe1597be441315cb76e8bfddf97c2344a5d206a
                                                                                                  SHA256:4a85bac71b81338df2e724c587995e231dfc0b32b004cfea253b8d94422cc4ba
                                                                                                  SHA512:c85f9f14342e6d49b9d43cf3475f91a5a54cfc4fb89397572027912f4c478b62e306ca0fa2a886e1c89e02c226583eb97eefc04fa45efa8f2d05086a12bf197c
                                                                                                  SSDEEP:24576:ctb20pkaCqT5TBWgNQ7a6Vjaab/dPQVW0hFdc6A:FVg5tQ7a6VeGV0WWFC5
                                                                                                  TLSH:C235BF1373DD8361C7B25273BA66B701AEBF782506A1F56B2FD4093DE920122521EB73
                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

                                                                                                  File Icon

                                                                                                  Icon Hash:aaf3e3e3938382a0

                                                                                                  Static PE Info

                                                                                                  General

                                                                                                  Entrypoint:0x425f74
                                                                                                  Entrypoint Section:.text
                                                                                                  Digitally signed:false
                                                                                                  Imagebase:0x400000
                                                                                                  Subsystem:windows gui
                                                                                                  Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                  DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                                  Time Stamp:0x673C0F19 [Tue Nov 19 04:07:53 2024 UTC]
                                                                                                  TLS Callbacks:
                                                                                                  CLR (.Net) Version:
                                                                                                  OS Version Major:5
                                                                                                  OS Version Minor:1
                                                                                                  File Version Major:5
                                                                                                  File Version Minor:1
                                                                                                  Subsystem Version Major:5
                                                                                                  Subsystem Version Minor:1
                                                                                                  Import Hash:3d95adbf13bbe79dc24dccb401c12091

                                                                                                  Entrypoint Preview

                                                                                                  Instruction
                                                                                                  call 00007F4054CD49CFh
                                                                                                  jmp 00007F4054CC79E4h
                                                                                                  int3
                                                                                                  int3
                                                                                                  push edi
                                                                                                  push esi
                                                                                                  mov esi, dword ptr [esp+10h]
                                                                                                  mov ecx, dword ptr [esp+14h]
                                                                                                  mov edi, dword ptr [esp+0Ch]
                                                                                                  mov eax, ecx
                                                                                                  mov edx, ecx
                                                                                                  add eax, esi
                                                                                                  cmp edi, esi
                                                                                                  jbe 00007F4054CC7B6Ah
                                                                                                  cmp edi, eax
                                                                                                  jc 00007F4054CC7ECEh
                                                                                                  bt dword ptr [004C0158h], 01h
                                                                                                  jnc 00007F4054CC7B69h
                                                                                                  rep movsb
                                                                                                  jmp 00007F4054CC7E7Ch
                                                                                                  cmp ecx, 00000080h
                                                                                                  jc 00007F4054CC7D34h
                                                                                                  mov eax, edi
                                                                                                  xor eax, esi
                                                                                                  test eax, 0000000Fh
                                                                                                  jne 00007F4054CC7B70h
                                                                                                  bt dword ptr [004BA370h], 01h
                                                                                                  jc 00007F4054CC8040h
                                                                                                  bt dword ptr [004C0158h], 00000000h
                                                                                                  jnc 00007F4054CC7D0Dh
                                                                                                  test edi, 00000003h
                                                                                                  jne 00007F4054CC7D1Eh
                                                                                                  test esi, 00000003h
                                                                                                  jne 00007F4054CC7CFDh
                                                                                                  bt edi, 02h
                                                                                                  jnc 00007F4054CC7B6Fh
                                                                                                  mov eax, dword ptr [esi]
                                                                                                  sub ecx, 04h
                                                                                                  lea esi, dword ptr [esi+04h]
                                                                                                  mov dword ptr [edi], eax
                                                                                                  lea edi, dword ptr [edi+04h]
                                                                                                  bt edi, 03h
                                                                                                  jnc 00007F4054CC7B73h
                                                                                                  movq xmm1, qword ptr [esi]
                                                                                                  sub ecx, 08h
                                                                                                  lea esi, dword ptr [esi+08h]
                                                                                                  movq qword ptr [edi], xmm1
                                                                                                  lea edi, dword ptr [edi+08h]
                                                                                                  test esi, 00000007h
                                                                                                  je 00007F4054CC7BC5h
                                                                                                  bt esi, 03h
                                                                                                  jnc 00007F4054CC7C18h
                                                                                                  movdqa xmm1, dqword ptr [esi+00h]

                                                                                                  Rich Headers

                                                                                                  Programming Language:
                                                                                                  • [ C ] VS2008 SP1 build 30729
                                                                                                  • [IMP] VS2008 SP1 build 30729
                                                                                                  • [ASM] VS2012 UPD4 build 61030
                                                                                                  • [RES] VS2012 UPD4 build 61030
                                                                                                  • [LNK] VS2012 UPD4 build 61030

                                                                                                  Data Directories

                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0xb70040x17c.rdata
                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0xc40000x465ec.rsrc
                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x10b0000x6c4c.reloc
                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x8d8d00x1c.rdata
                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb27300x40.rdata
                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x8d0000x860.rdata
                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                  Sections

                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                  .text0x10000x8b54f0x8b600f437a6545e938612764dbb0a314376fcFalse0.5699499019058296data6.680413749210956IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                  .rdata0x8d0000x2cc420x2ce00827ffd24759e8e420890ecf164be989eFalse0.330464397632312data5.770192333189168IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                  .data0xba0000x9d540x6200e0a519f8e3a35fae0d9c2cfd5a4bacfcFalse0.16402264030612246data2.002691099965349IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                  .rsrc0xc40000x465ec0x46600d07f6110437a0113e29b436c3d84191bFalse0.9074468527975134data7.84576014720181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                  .reloc0x10b0000xa4740xa6000bc98f8631ef0bde830a7f83bb06ff08False0.5017884036144579data5.245426654116355IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                  Resources

                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                  RT_ICON0xc45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                                  RT_ICON0xc46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                                  RT_ICON0xc47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                                  RT_ICON0xc49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                                                                  RT_ICON0xc4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                                                                  RT_ICON0xc4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                                                                  RT_ICON0xc5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                                                                  RT_ICON0xc64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                                                                  RT_ICON0xc69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                                                                  RT_ICON0xc8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                                                                  RT_ICON0xca0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                                                                  RT_MENU0xca4a00x50dataEnglishGreat Britain0.9
                                                                                                  RT_STRING0xca4f00x594dataEnglishGreat Britain0.3333333333333333
                                                                                                  RT_STRING0xcaa840x68adataEnglishGreat Britain0.2747909199522103
                                                                                                  RT_STRING0xcb1100x490dataEnglishGreat Britain0.3715753424657534
                                                                                                  RT_STRING0xcb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                                  RT_STRING0xcbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                                                                  RT_STRING0xcc1f80x466dataEnglishGreat Britain0.3605683836589698
                                                                                                  RT_STRING0xcc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                                                                  RT_RCDATA0xcc7b80x3d8f1data1.0003410735886098
                                                                                                  RT_GROUP_ICON0x10a0ac0x76dataEnglishGreat Britain0.6610169491525424
                                                                                                  RT_GROUP_ICON0x10a1240x14dataEnglishGreat Britain1.25
                                                                                                  RT_GROUP_ICON0x10a1380x14dataEnglishGreat Britain1.15
                                                                                                  RT_GROUP_ICON0x10a14c0x14dataEnglishGreat Britain1.25
                                                                                                  RT_VERSION0x10a1600xdcdataEnglishGreat Britain0.6181818181818182
                                                                                                  RT_MANIFEST0x10a23c0x3b0ASCII text, with CRLF line terminatorsEnglishGreat Britain0.5116525423728814

                                                                                                  Imports

                                                                                                  DLLImport
                                                                                                  WSOCK32.dll__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
                                                                                                  VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                                                                  WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                                  COMCTL32.dllImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
                                                                                                  MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                                                                                  WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
                                                                                                  PSAPI.DLLGetProcessMemoryInfo
                                                                                                  IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                                                                                  USERENV.dllUnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
                                                                                                  UxTheme.dllIsThemeActive
                                                                                                  KERNEL32.dllHeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
                                                                                                  USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
                                                                                                  GDI32.dllSetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
                                                                                                  COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                                  ADVAPI32.dllGetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
                                                                                                  SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                                  ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                                                                  OLEAUT32.dllRegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

                                                                                                  Possible Origin

                                                                                                  Language of compilation systemCountry where language is spokenMap
                                                                                                  EnglishGreat Britain

                                                                                                  Network Behavior

                                                                                                  Network Port Distribution

                                                                                                  UDP Packets

                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                  Nov 25, 2024 13:59:36.853682995 CET6127853192.168.2.71.1.1.1
                                                                                                  Nov 25, 2024 13:59:37.174107075 CET53612781.1.1.1192.168.2.7
                                                                                                  Nov 25, 2024 13:59:57.196408033 CET6101353192.168.2.71.1.1.1
                                                                                                  Nov 25, 2024 13:59:57.566082954 CET53610131.1.1.1192.168.2.7
                                                                                                  Nov 25, 2024 14:00:17.371037960 CET5973753192.168.2.71.1.1.1
                                                                                                  Nov 25, 2024 14:00:17.611284018 CET53597371.1.1.1192.168.2.7
                                                                                                  Nov 25, 2024 14:00:38.561388016 CET6075753192.168.2.71.1.1.1
                                                                                                  Nov 25, 2024 14:00:38.800378084 CET53607571.1.1.1192.168.2.7
                                                                                                  Nov 25, 2024 14:01:00.789810896 CET6003253192.168.2.71.1.1.1
                                                                                                  Nov 25, 2024 14:01:01.023050070 CET53600321.1.1.1192.168.2.7

                                                                                                  DNS Queries

                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                  Nov 25, 2024 13:59:36.853682995 CET192.168.2.71.1.1.10x266cStandard query (0)www.unluoren.topA (IP address)IN (0x0001)false
                                                                                                  Nov 25, 2024 13:59:57.196408033 CET192.168.2.71.1.1.10xfe8Standard query (0)www.narchists.infoA (IP address)IN (0x0001)false
                                                                                                  Nov 25, 2024 14:00:17.371037960 CET192.168.2.71.1.1.10x8703Standard query (0)www.ec.babyA (IP address)IN (0x0001)false
                                                                                                  Nov 25, 2024 14:00:38.561388016 CET192.168.2.71.1.1.10xcdefStandard query (0)www.2creativedesign.onlineA (IP address)IN (0x0001)false
                                                                                                  Nov 25, 2024 14:01:00.789810896 CET192.168.2.71.1.1.10xcbcaStandard query (0)www.edcn.linkA (IP address)IN (0x0001)false

                                                                                                  DNS Answers

                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                  Nov 25, 2024 13:59:37.174107075 CET1.1.1.1192.168.2.70x266cName error (3)www.unluoren.topnonenoneA (IP address)IN (0x0001)false
                                                                                                  Nov 25, 2024 13:59:57.566082954 CET1.1.1.1192.168.2.70xfe8Name error (3)www.narchists.infononenoneA (IP address)IN (0x0001)false
                                                                                                  Nov 25, 2024 14:00:17.611284018 CET1.1.1.1192.168.2.70x8703Name error (3)www.ec.babynonenoneA (IP address)IN (0x0001)false
                                                                                                  Nov 25, 2024 14:00:38.800378084 CET1.1.1.1192.168.2.70xcdefName error (3)www.2creativedesign.onlinenonenoneA (IP address)IN (0x0001)false
                                                                                                  Nov 25, 2024 14:01:01.023050070 CET1.1.1.1192.168.2.70xcbcaName error (3)www.edcn.linknonenoneA (IP address)IN (0x0001)false

                                                                                                  Code Manipulations

                                                                                                  User Modules

                                                                                                  Hook Summary

                                                                                                  Function NameHook TypeActive in Processes
                                                                                                  PeekMessageAINLINEexplorer.exe
                                                                                                  PeekMessageWINLINEexplorer.exe
                                                                                                  GetMessageWINLINEexplorer.exe
                                                                                                  GetMessageAINLINEexplorer.exe

                                                                                                  Processes

                                                                                                  Process: explorer.exe, Module: user32.dll
                                                                                                  Function NameHook TypeNew Data
                                                                                                  PeekMessageAINLINE0x48 0x8B 0xB8 0x84 0x4E 0xEC
                                                                                                  PeekMessageWINLINE0x48 0x8B 0xB8 0x8C 0xCE 0xEC
                                                                                                  GetMessageWINLINE0x48 0x8B 0xB8 0x8C 0xCE 0xEC
                                                                                                  GetMessageAINLINE0x48 0x8B 0xB8 0x84 0x4E 0xEC

                                                                                                  Statistics

                                                                                                  CPU Usage

                                                                                                  Click to jump to process

                                                                                                  Memory Usage

                                                                                                  Click to jump to process

                                                                                                  High Level Behavior Distribution

                                                                                                  Click to dive into process behavior distribution

                                                                                                  Behavior

                                                                                                  Click to jump to process

                                                                                                  System Behavior

                                                                                                  General

                                                                                                  Target ID:4
                                                                                                  Start time:07:58:55
                                                                                                  Start date:25/11/2024
                                                                                                  Path:C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe
                                                                                                  Wow64 process (32bit):true
                                                                                                  Commandline:"C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe"
                                                                                                  Imagebase:0x3c0000
                                                                                                  File size:1'111'552 bytes
                                                                                                  MD5 hash:B333B741B51E1FA861D44C2846939182
                                                                                                  Has elevated privileges:true
                                                                                                  Has administrator privileges:true
                                                                                                  Programmed in:C, C++ or other language
                                                                                                  Yara matches:
                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.1304346396.0000000003A90000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                  Reputation:low
                                                                                                  Has exited:true

                                                                                                  General

                                                                                                  Target ID:7
                                                                                                  Start time:07:58:57
                                                                                                  Start date:25/11/2024
                                                                                                  Path:C:\Windows\SysWOW64\svchost.exe
                                                                                                  Wow64 process (32bit):true
                                                                                                  Commandline:"C:\Users\user\Desktop\brief nr. 001150_51_2024-11-19_134943.docx.exe"
                                                                                                  Imagebase:0xba0000
                                                                                                  File size:46'504 bytes
                                                                                                  MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                                                  Has elevated privileges:true
                                                                                                  Has administrator privileges:true
                                                                                                  Programmed in:C, C++ or other language
                                                                                                  Yara matches:
                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.1375503521.0000000002BB0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.1377269448.0000000003950000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.1374414636.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                  Reputation:high
                                                                                                  Has exited:true

                                                                                                  General

                                                                                                  Target ID:8
                                                                                                  Start time:07:58:58
                                                                                                  Start date:25/11/2024
                                                                                                  Path:C:\Windows\explorer.exe
                                                                                                  Wow64 process (32bit):false
                                                                                                  Commandline:C:\Windows\Explorer.EXE
                                                                                                  Imagebase:0x7ff70ffd0000
                                                                                                  File size:5'141'208 bytes
                                                                                                  MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                  Has elevated privileges:false
                                                                                                  Has administrator privileges:false
                                                                                                  Programmed in:C, C++ or other language
                                                                                                  Reputation:high
                                                                                                  Has exited:false

                                                                                                  General

                                                                                                  Target ID:10
                                                                                                  Start time:07:59:02
                                                                                                  Start date:25/11/2024
                                                                                                  Path:C:\Windows\SysWOW64\help.exe
                                                                                                  Wow64 process (32bit):true
                                                                                                  Commandline:"C:\Windows\SysWOW64\help.exe"
                                                                                                  Imagebase:0x9c0000
                                                                                                  File size:10'240 bytes
                                                                                                  MD5 hash:DD40774E56D4C44B81F2DFA059285E75
                                                                                                  Has elevated privileges:false
                                                                                                  Has administrator privileges:false
                                                                                                  Programmed in:C, C++ or other language
                                                                                                  Yara matches:
                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.2542765541.00000000030B0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.2543812721.0000000003590000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                  • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                  • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                  • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                  • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.2543653526.0000000003550000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                  Reputation:moderate
                                                                                                  Has exited:false

                                                                                                  General

                                                                                                  Target ID:11
                                                                                                  Start time:07:59:06
                                                                                                  Start date:25/11/2024
                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                  Wow64 process (32bit):true
                                                                                                  Commandline:/c del "C:\Windows\SysWOW64\svchost.exe"
                                                                                                  Imagebase:0x410000
                                                                                                  File size:236'544 bytes
                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                  Has elevated privileges:false
                                                                                                  Has administrator privileges:false
                                                                                                  Programmed in:C, C++ or other language
                                                                                                  Reputation:high
                                                                                                  Has exited:true

                                                                                                  General

                                                                                                  Target ID:12
                                                                                                  Start time:07:59:06
                                                                                                  Start date:25/11/2024
                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                  Wow64 process (32bit):false
                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  Imagebase:0x7ff75da10000
                                                                                                  File size:862'208 bytes
                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                  Has elevated privileges:false
                                                                                                  Has administrator privileges:false
                                                                                                  Programmed in:C, C++ or other language
                                                                                                  Reputation:high
                                                                                                  Has exited:true

                                                                                                  Disassembly

                                                                                                  Reset < >

                                                                                                    Execution Graph

                                                                                                    Execution Coverage:4.2%
                                                                                                    Dynamic/Decrypted Code Coverage:0.4%
                                                                                                    Signature Coverage:7%
                                                                                                    Total number of Nodes:2000
                                                                                                    Total number of Limit Nodes:175
                                                                                                    execution_graph 93062 128b808 93076 1289458 93062->93076 93064 128b8d3 93079 128b6f8 93064->93079 93082 128c8f8 GetPEB 93076->93082 93078 1289ae3 93078->93064 93080 128b701 Sleep 93079->93080 93081 128b70f 93080->93081 93083 128c922 93082->93083 93083->93078 93084 3e5dfd 93085 3e5e09 __wsopen_helper 93084->93085 93121 3e7eeb GetStartupInfoW 93085->93121 93087 3e5e0e 93123 3e9ca7 GetProcessHeap 93087->93123 93089 3e5e66 93090 3e5e71 93089->93090 93208 3e5f4d 47 API calls 3 library calls 93089->93208 93124 3e7b47 93090->93124 93093 3e5e77 93094 3e5e82 __RTC_Initialize 93093->93094 93209 3e5f4d 47 API calls 3 library calls 93093->93209 93145 3eacb3 93094->93145 93097 3e5e91 93098 3e5e9d GetCommandLineW 93097->93098 93210 3e5f4d 47 API calls 3 library calls 93097->93210 93164 3f2e7d GetEnvironmentStringsW 93098->93164 93101 3e5e9c 93101->93098 93105 3e5ec2 93177 3f2cb4 93105->93177 93108 3e5ec8 93109 3e5ed3 93108->93109 93212 3e115b 47 API calls 3 library calls 93108->93212 93191 3e1195 93109->93191 93112 3e5edb 93114 3e5ee6 __wwincmdln 93112->93114 93213 3e115b 47 API calls 3 library calls 93112->93213 93195 3c3a0f 93114->93195 93116 3e5efa 93117 3e5f09 93116->93117 93214 3e13f1 47 API calls _doexit 93116->93214 93215 3e1186 47 API calls _doexit 93117->93215 93120 3e5f0e __wsopen_helper 93122 3e7f01 93121->93122 93122->93087 93123->93089 93216 3e123a 30 API calls 2 library calls 93124->93216 93126 3e7b4c 93217 3e7e23 InitializeCriticalSectionAndSpinCount 93126->93217 93128 3e7b51 93129 3e7b55 93128->93129 93219 3e7e6d TlsAlloc 93128->93219 93218 3e7bbd 50 API calls 2 library calls 93129->93218 93132 3e7b5a 93132->93093 93133 3e7b67 93133->93129 93134 3e7b72 93133->93134 93220 3e6986 93134->93220 93137 3e7bb4 93228 3e7bbd 50 API calls 2 library calls 93137->93228 93140 3e7bb9 93140->93093 93141 3e7b93 93141->93137 93142 3e7b99 93141->93142 93227 3e7a94 47 API calls 4 library calls 93142->93227 93144 3e7ba1 GetCurrentThreadId 93144->93093 93146 3eacbf __wsopen_helper 93145->93146 93237 3e7cf4 93146->93237 93148 3eacc6 93149 3e6986 __calloc_crt 47 API calls 93148->93149 93151 3eacd7 93149->93151 93150 3ead42 GetStartupInfoW 93159 3eae80 93150->93159 93161 3ead57 93150->93161 93151->93150 93152 3eace2 __wsopen_helper @_EH4_CallFilterFunc@8 93151->93152 93152->93097 93153 3eaf44 93244 3eaf58 LeaveCriticalSection _doexit 93153->93244 93155 3eaec9 GetStdHandle 93155->93159 93156 3eada5 93156->93159 93162 3eadd7 GetFileType 93156->93162 93163 3eade5 InitializeCriticalSectionAndSpinCount 93156->93163 93157 3e6986 __calloc_crt 47 API calls 93157->93161 93158 3eaedb GetFileType 93158->93159 93159->93153 93159->93155 93159->93158 93160 3eaf08 InitializeCriticalSectionAndSpinCount 93159->93160 93160->93159 93161->93156 93161->93157 93161->93159 93162->93156 93162->93163 93163->93156 93165 3f2e8e 93164->93165 93166 3e5ead 93164->93166 93283 3e69d0 47 API calls __crtLCMapStringA_stat 93165->93283 93171 3f2a7b GetModuleFileNameW 93166->93171 93169 3f2eb4 _memcpy_s 93170 3f2eca FreeEnvironmentStringsW 93169->93170 93170->93166 93172 3f2aaf _wparse_cmdline 93171->93172 93173 3e5eb7 93172->93173 93174 3f2ae9 93172->93174 93173->93105 93211 3e115b 47 API calls 3 library calls 93173->93211 93284 3e69d0 47 API calls __crtLCMapStringA_stat 93174->93284 93176 3f2aef _wparse_cmdline 93176->93173 93178 3f2ccd __wsetenvp 93177->93178 93182 3f2cc5 93177->93182 93179 3e6986 __calloc_crt 47 API calls 93178->93179 93187 3f2cf6 __wsetenvp 93179->93187 93180 3f2d4d 93181 3e1c9d _free 47 API calls 93180->93181 93181->93182 93182->93108 93183 3e6986 __calloc_crt 47 API calls 93183->93187 93184 3f2d72 93185 3e1c9d _free 47 API calls 93184->93185 93185->93182 93187->93180 93187->93182 93187->93183 93187->93184 93188 3f2d89 93187->93188 93285 3f2567 47 API calls __wopenfile 93187->93285 93286 3e6e20 IsProcessorFeaturePresent 93188->93286 93190 3f2d95 93190->93108 93192 3e11a1 __initterm_e __initp_misc_cfltcvt_tab __IsNonwritableInCurrentImage 93191->93192 93194 3e11e0 __IsNonwritableInCurrentImage 93192->93194 93309 3e0f0a 52 API calls __cinit 93192->93309 93194->93112 93196 3c3a29 93195->93196 93197 431ebf 93195->93197 93198 3c3a63 IsThemeActive 93196->93198 93310 3e1405 93198->93310 93202 3c3a8f 93322 3c3adb SystemParametersInfoW SystemParametersInfoW 93202->93322 93204 3c3a9b 93323 3c3d19 93204->93323 93206 3c3aa3 SystemParametersInfoW 93207 3c3ac8 93206->93207 93207->93116 93208->93090 93209->93094 93210->93101 93214->93117 93215->93120 93216->93126 93217->93128 93218->93132 93219->93133 93223 3e698d 93220->93223 93222 3e69ca 93222->93137 93226 3e7ec9 TlsSetValue 93222->93226 93223->93222 93224 3e69ab Sleep 93223->93224 93229 3f30aa 93223->93229 93225 3e69c2 93224->93225 93225->93222 93225->93223 93226->93141 93227->93144 93228->93140 93230 3f30b5 93229->93230 93231 3f30d0 __calloc_impl 93229->93231 93230->93231 93232 3f30c1 93230->93232 93234 3f30e0 HeapAlloc 93231->93234 93235 3f30c6 93231->93235 93236 3e7c0e 47 API calls __getptd_noexit 93232->93236 93234->93231 93234->93235 93235->93223 93236->93235 93238 3e7d18 EnterCriticalSection 93237->93238 93239 3e7d05 93237->93239 93238->93148 93245 3e7d7c 93239->93245 93241 3e7d0b 93241->93238 93269 3e115b 47 API calls 3 library calls 93241->93269 93244->93152 93246 3e7d88 __wsopen_helper 93245->93246 93247 3e7da9 93246->93247 93248 3e7d91 93246->93248 93250 3e7da7 93247->93250 93256 3e7e11 __wsopen_helper 93247->93256 93270 3e81c2 47 API calls 2 library calls 93248->93270 93250->93247 93273 3e69d0 47 API calls __crtLCMapStringA_stat 93250->93273 93251 3e7d96 93271 3e821f 47 API calls 8 library calls 93251->93271 93254 3e7dbd 93257 3e7dc4 93254->93257 93258 3e7dd3 93254->93258 93255 3e7d9d 93272 3e1145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 93255->93272 93256->93241 93274 3e7c0e 47 API calls __getptd_noexit 93257->93274 93261 3e7cf4 __lock 46 API calls 93258->93261 93263 3e7dda 93261->93263 93262 3e7dc9 93262->93256 93264 3e7dfe 93263->93264 93265 3e7de9 InitializeCriticalSectionAndSpinCount 93263->93265 93275 3e1c9d 93264->93275 93266 3e7e04 93265->93266 93281 3e7e1a LeaveCriticalSection _doexit 93266->93281 93270->93251 93271->93255 93273->93254 93274->93262 93276 3e1ca6 RtlFreeHeap 93275->93276 93277 3e1ccf __dosmaperr 93275->93277 93276->93277 93278 3e1cbb 93276->93278 93277->93266 93282 3e7c0e 47 API calls __getptd_noexit 93278->93282 93280 3e1cc1 GetLastError 93280->93277 93281->93256 93282->93280 93283->93169 93284->93176 93285->93187 93287 3e6e2b 93286->93287 93292 3e6cb5 93287->93292 93291 3e6e46 93291->93190 93293 3e6ccf _memset __call_reportfault 93292->93293 93294 3e6cef IsDebuggerPresent 93293->93294 93300 3e81ac SetUnhandledExceptionFilter UnhandledExceptionFilter 93294->93300 93297 3e6db3 __call_reportfault 93301 3ea70c 93297->93301 93298 3e6dd6 93299 3e8197 GetCurrentProcess TerminateProcess 93298->93299 93299->93291 93300->93297 93302 3ea716 IsProcessorFeaturePresent 93301->93302 93303 3ea714 93301->93303 93305 3f37b0 93302->93305 93303->93298 93308 3f375f 5 API calls 2 library calls 93305->93308 93307 3f3893 93307->93298 93308->93307 93309->93194 93311 3e7cf4 __lock 47 API calls 93310->93311 93312 3e1410 93311->93312 93375 3e7e58 LeaveCriticalSection 93312->93375 93314 3c3a88 93315 3e146d 93314->93315 93316 3e1477 93315->93316 93317 3e1491 93315->93317 93316->93317 93376 3e7c0e 47 API calls __getptd_noexit 93316->93376 93317->93202 93319 3e1481 93377 3e6e10 8 API calls __wopenfile 93319->93377 93321 3e148c 93321->93202 93322->93204 93324 3c3d26 __ftell_nolock 93323->93324 93378 3cd7f7 93324->93378 93328 3c3d57 IsDebuggerPresent 93329 431cc1 MessageBoxA 93328->93329 93330 3c3d65 93328->93330 93333 431cd9 93329->93333 93331 3c3e3a 93330->93331 93330->93333 93334 3c3d82 93330->93334 93332 3c3e41 SetCurrentDirectoryW 93331->93332 93335 3c3e4e Mailbox 93332->93335 93580 3dc682 48 API calls 93333->93580 93457 3c40e5 93334->93457 93335->93206 93338 431ce9 93343 431cff SetCurrentDirectoryW 93338->93343 93340 3c3da0 GetFullPathNameW 93473 3c6a63 93340->93473 93342 3c3ddb 93484 3c6430 93342->93484 93343->93335 93346 3c3df6 93347 3c3e00 93346->93347 93581 4071fa AllocateAndInitializeSid CheckTokenMembership FreeSid 93346->93581 93500 3c3e6e GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 93347->93500 93351 431d1c 93351->93347 93353 431d2d 93351->93353 93582 3c5374 93353->93582 93354 3c3e0a 93356 3c3e1f 93354->93356 93508 3c4ffc 93354->93508 93518 3ce8d0 93356->93518 93357 431d35 93589 3cce19 93357->93589 93362 431d42 93364 431d49 93362->93364 93365 431d6e 93362->93365 93595 3c518c 93364->93595 93366 3c518c 48 API calls 93365->93366 93368 431d6a GetForegroundWindow ShellExecuteW 93366->93368 93372 431d9e Mailbox 93368->93372 93372->93331 93375->93314 93376->93319 93377->93321 93614 3df4ea 93378->93614 93380 3cd818 93381 3df4ea 48 API calls 93380->93381 93382 3c3d31 GetCurrentDirectoryW 93381->93382 93383 3c61ca 93382->93383 93645 3de99b 93383->93645 93387 3c61eb 93388 3c5374 50 API calls 93387->93388 93389 3c61ff 93388->93389 93390 3cce19 48 API calls 93389->93390 93391 3c620c 93390->93391 93662 3c39db 93391->93662 93393 3c6216 Mailbox 93674 3c6eed 93393->93674 93398 3cce19 48 API calls 93399 3c6244 93398->93399 93681 3cd6e9 93399->93681 93401 3c6254 Mailbox 93402 3cce19 48 API calls 93401->93402 93403 3c627c 93402->93403 93404 3cd6e9 55 API calls 93403->93404 93405 3c628f Mailbox 93404->93405 93406 3cce19 48 API calls 93405->93406 93407 3c62a0 93406->93407 93685 3cd645 93407->93685 93409 3c62b2 Mailbox 93410 3cd7f7 48 API calls 93409->93410 93411 3c62c5 93410->93411 93695 3c63fc 93411->93695 93415 3c62df 93416 3c62e9 93415->93416 93417 431c08 93415->93417 93419 3e0fa7 _W_store_winword 59 API calls 93416->93419 93418 3c63fc 48 API calls 93417->93418 93421 431c1c 93418->93421 93420 3c62f4 93419->93420 93420->93421 93422 3c62fe 93420->93422 93424 3c63fc 48 API calls 93421->93424 93423 3e0fa7 _W_store_winword 59 API calls 93422->93423 93425 3c6309 93423->93425 93426 431c38 93424->93426 93425->93426 93427 3c6313 93425->93427 93429 3c5374 50 API calls 93426->93429 93428 3e0fa7 _W_store_winword 59 API calls 93427->93428 93431 3c631e 93428->93431 93430 431c5d 93429->93430 93432 3c63fc 48 API calls 93430->93432 93433 3c635f 93431->93433 93435 431c86 93431->93435 93438 3c63fc 48 API calls 93431->93438 93434 431c69 93432->93434 93433->93435 93436 3c636c 93433->93436 93437 3c6eed 48 API calls 93434->93437 93439 3c6eed 48 API calls 93435->93439 93711 3dc050 93436->93711 93441 431c77 93437->93441 93442 3c6342 93438->93442 93443 431ca8 93439->93443 93445 3c63fc 48 API calls 93441->93445 93446 3c6eed 48 API calls 93442->93446 93447 3c63fc 48 API calls 93443->93447 93444 3c6384 93722 3d1b90 93444->93722 93445->93435 93449 3c6350 93446->93449 93450 431cb5 93447->93450 93451 3c63fc 48 API calls 93449->93451 93450->93450 93451->93433 93452 3d1b90 48 API calls 93454 3c6394 93452->93454 93454->93452 93455 3c63fc 48 API calls 93454->93455 93456 3c63d6 Mailbox 93454->93456 93738 3c6b68 48 API calls 93454->93738 93455->93454 93456->93328 93458 3c40f2 __ftell_nolock 93457->93458 93459 3c410b 93458->93459 93460 43370e _memset 93458->93460 94397 3c660f 93459->94397 93463 43372a GetOpenFileNameW 93460->93463 93464 433779 93463->93464 93466 3c6a63 48 API calls 93464->93466 93468 43378e 93466->93468 93468->93468 93470 3c4129 94422 3c4139 93470->94422 93474 3c6adf 93473->93474 93475 3c6a6f __wsetenvp 93473->93475 93476 3cb18b 48 API calls 93474->93476 93477 3c6a8b 93475->93477 93478 3c6ad7 93475->93478 93481 3c6ab6 _memcpy_s 93476->93481 94642 3c6b4a 93477->94642 94645 3cc369 48 API calls 93478->94645 93481->93342 93482 3c6a95 93483 3dee75 48 API calls 93482->93483 93483->93481 93485 3c643d __ftell_nolock 93484->93485 94646 3c4c75 93485->94646 93487 3c6442 93499 3c3dee 93487->93499 94657 3c5928 86 API calls 93487->94657 93489 3c644f 93489->93499 94658 3c5798 88 API calls Mailbox 93489->94658 93491 3c6458 93492 3c645c GetFullPathNameW 93491->93492 93491->93499 93493 3c6a63 48 API calls 93492->93493 93494 3c6488 93493->93494 93495 3c6a63 48 API calls 93494->93495 93496 3c6495 93495->93496 93497 435dcf _wcscat 93496->93497 93498 3c6a63 48 API calls 93496->93498 93498->93499 93499->93338 93499->93346 93501 3c3ed8 93500->93501 93502 431cba 93500->93502 94705 3c4024 93501->94705 93506 3c3e05 93507 3c36b8 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 93506->93507 93507->93354 93509 3c5027 _memset 93508->93509 94710 3c4c30 93509->94710 93512 3c50ac 93514 3c50ca Shell_NotifyIconW 93512->93514 93515 433d28 Shell_NotifyIconW 93512->93515 94714 3c51af 93514->94714 93517 3c50df 93517->93356 93519 3ce8f6 93518->93519 93578 3ce906 Mailbox 93518->93578 93520 3ced52 93519->93520 93519->93578 94907 3de3cd 335 API calls 93520->94907 93522 3c3e2a 93522->93331 93579 3c3847 Shell_NotifyIconW _memset 93522->93579 93524 3ced63 93524->93522 93526 3ced70 93524->93526 93525 3ce94c PeekMessageW 93525->93578 94909 3de312 335 API calls Mailbox 93526->94909 93527 43526e Sleep 93527->93578 93529 3ced77 LockWindowUpdate DestroyWindow GetMessageW 93529->93522 93533 3ceda9 93529->93533 93532 3cebc7 93532->93522 94908 3c2ff6 16 API calls 93532->94908 93534 4359ef TranslateMessage DispatchMessageW GetMessageW 93533->93534 93534->93534 93535 435a1f 93534->93535 93535->93522 93536 3ced21 PeekMessageW 93536->93578 93537 3cebf7 timeGetTime 93537->93578 93539 3c6eed 48 API calls 93539->93578 93540 435557 WaitForSingleObject 93543 435574 GetExitCodeProcess CloseHandle 93540->93543 93540->93578 93541 3df4ea 48 API calls 93541->93578 93542 3c2aae 311 API calls 93542->93578 93543->93578 93544 43588f Sleep 93573 435429 Mailbox 93544->93573 93545 3ced3a TranslateMessage DispatchMessageW 93545->93536 93546 3cd7f7 48 API calls 93546->93573 93547 3cedae timeGetTime 94910 3c1caa 49 API calls 93547->94910 93549 3ddc38 timeGetTime 93549->93573 93551 435733 Sleep 93551->93573 93553 435926 GetExitCodeProcess 93556 435952 CloseHandle 93553->93556 93557 43593c WaitForSingleObject 93553->93557 93555 435445 Sleep 93555->93578 93556->93573 93557->93556 93557->93578 93558 435432 Sleep 93558->93555 93559 428c4b 108 API calls 93559->93573 93560 3c2c79 107 API calls 93560->93573 93562 4359ae Sleep 93562->93578 93563 3c1caa 49 API calls 93563->93578 93566 3cce19 48 API calls 93566->93573 93569 3cd6e9 55 API calls 93569->93573 93573->93546 93573->93549 93573->93553 93573->93555 93573->93558 93573->93559 93573->93560 93573->93562 93573->93566 93573->93569 93573->93578 94912 404cbe 49 API calls Mailbox 93573->94912 94913 3c1caa 49 API calls 93573->94913 94914 3c2aae 335 API calls 93573->94914 94944 41ccb2 50 API calls 93573->94944 94945 407a58 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 93573->94945 94946 406532 63 API calls 3 library calls 93573->94946 93574 3cce19 48 API calls 93574->93578 93576 40cc5c 86 API calls 93576->93578 93577 3cd6e9 55 API calls 93577->93578 93578->93525 93578->93527 93578->93532 93578->93536 93578->93537 93578->93539 93578->93540 93578->93541 93578->93542 93578->93544 93578->93545 93578->93547 93578->93551 93578->93555 93578->93563 93578->93573 93578->93574 93578->93576 93578->93577 94737 3cef00 93578->94737 94742 3cf110 93578->94742 94807 3d45e0 93578->94807 94824 3de244 93578->94824 94829 3ddc5f 93578->94829 94834 3ceed0 335 API calls Mailbox 93578->94834 94835 3d3200 93578->94835 94911 428d23 48 API calls 93578->94911 94915 3cfe30 93578->94915 93579->93331 93580->93338 93581->93351 93583 3ef8a0 __ftell_nolock 93582->93583 93584 3c5381 GetModuleFileNameW 93583->93584 93585 3cce19 48 API calls 93584->93585 93586 3c53a7 93585->93586 93587 3c660f 49 API calls 93586->93587 93588 3c53b1 Mailbox 93587->93588 93588->93357 93590 3cce28 __wsetenvp 93589->93590 93591 3dee75 48 API calls 93590->93591 93592 3cce50 _memcpy_s 93591->93592 93593 3df4ea 48 API calls 93592->93593 93594 3cce66 93593->93594 93594->93362 93596 3c5197 93595->93596 93597 3c519f 93596->93597 93598 431ace 93596->93598 95211 3c5130 93597->95211 93600 3c6b4a 48 API calls 93598->93600 93616 3df4f2 __calloc_impl 93614->93616 93617 3df50c 93616->93617 93618 3df50e std::exception::exception 93616->93618 93623 3e395c 93616->93623 93617->93380 93637 3e6805 RaiseException 93618->93637 93620 3df538 93638 3e673b 47 API calls _free 93620->93638 93622 3df54a 93622->93380 93624 3e39d7 __calloc_impl 93623->93624 93633 3e3968 __calloc_impl 93623->93633 93644 3e7c0e 47 API calls __getptd_noexit 93624->93644 93625 3e3973 93625->93633 93639 3e81c2 47 API calls 2 library calls 93625->93639 93640 3e821f 47 API calls 8 library calls 93625->93640 93641 3e1145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 93625->93641 93628 3e399b RtlAllocateHeap 93628->93633 93636 3e39cf 93628->93636 93630 3e39c3 93642 3e7c0e 47 API calls __getptd_noexit 93630->93642 93633->93625 93633->93628 93633->93630 93634 3e39c1 93633->93634 93643 3e7c0e 47 API calls __getptd_noexit 93634->93643 93636->93616 93637->93620 93638->93622 93639->93625 93640->93625 93642->93634 93643->93636 93644->93636 93646 3cd7f7 48 API calls 93645->93646 93647 3c61db 93646->93647 93648 3c6009 93647->93648 93649 3c6016 __ftell_nolock 93648->93649 93650 3c6a63 48 API calls 93649->93650 93654 3c617c Mailbox 93649->93654 93651 3c6048 93650->93651 93660 3c607e Mailbox 93651->93660 93739 3c61a6 93651->93739 93653 3c614f 93653->93654 93655 3cce19 48 API calls 93653->93655 93654->93387 93657 3c6170 93655->93657 93656 3cce19 48 API calls 93656->93660 93659 3c64cf 48 API calls 93657->93659 93658 3c61a6 48 API calls 93658->93660 93659->93654 93660->93653 93660->93654 93660->93656 93660->93658 93742 3c64cf 93660->93742 93765 3c41a9 93662->93765 93665 3c3a06 93665->93393 93668 3e1c9d _free 47 API calls 93671 432ffd 93668->93671 93670 432ff0 93670->93668 93672 3c4252 84 API calls 93671->93672 93673 433006 93672->93673 93673->93673 93675 3c6ef8 93674->93675 93676 3c622b 93674->93676 94385 3cdd47 48 API calls _memcpy_s 93675->94385 93678 3c9048 93676->93678 93679 3df4ea 48 API calls 93678->93679 93680 3c6237 93679->93680 93680->93398 93682 3cd6f4 93681->93682 93683 3cd71b 93682->93683 94386 3cd764 55 API calls 93682->94386 93683->93401 93686 3cd654 93685->93686 93694 3cd67e 93685->93694 93687 3cd65b 93686->93687 93690 3cd6c2 93686->93690 93688 3cd666 93687->93688 93693 3cd6ab 93687->93693 94387 3cd9a0 53 API calls __cinit 93688->94387 93690->93693 94389 3ddce0 53 API calls 93690->94389 93693->93694 94388 3ddce0 53 API calls 93693->94388 93694->93409 93696 3c641f 93695->93696 93697 3c6406 93695->93697 93699 3c6a63 48 API calls 93696->93699 93698 3c6eed 48 API calls 93697->93698 93700 3c62d1 93698->93700 93699->93700 93701 3e0fa7 93700->93701 93702 3e1028 93701->93702 93703 3e0fb3 93701->93703 94392 3e103a 59 API calls 3 library calls 93702->94392 93707 3e0fd8 93703->93707 94390 3e7c0e 47 API calls __getptd_noexit 93703->94390 93706 3e1035 93706->93415 93707->93415 93708 3e0fbf 94391 3e6e10 8 API calls __wopenfile 93708->94391 93710 3e0fca 93710->93415 93712 3dc064 93711->93712 93714 3dc069 Mailbox 93711->93714 94393 3dc1af 48 API calls 93712->94393 93720 3dc077 93714->93720 94394 3dc15c 48 API calls 93714->94394 93716 3df4ea 48 API calls 93718 3dc108 93716->93718 93717 3dc152 93717->93444 93719 3df4ea 48 API calls 93718->93719 93721 3dc113 93719->93721 93720->93716 93720->93717 93721->93444 93721->93721 93723 3d1cf6 93722->93723 93725 3d1ba2 93722->93725 93723->93454 93727 3df4ea 48 API calls 93725->93727 93736 3d1bae 93725->93736 93726 3d1bb9 93730 3d1c5d 93726->93730 93731 3df4ea 48 API calls 93726->93731 93728 4349c4 93727->93728 93729 3df4ea 48 API calls 93728->93729 93737 4349cf 93729->93737 93730->93454 93732 3d1c9f 93731->93732 93733 3d1cb2 93732->93733 94395 3c2925 48 API calls 93732->94395 93733->93454 93735 3df4ea 48 API calls 93735->93737 93736->93726 94396 3dc15c 48 API calls 93736->94396 93737->93735 93737->93736 93738->93454 93748 3cbdfa 93739->93748 93741 3c61b1 93741->93651 93743 3c651b 93742->93743 93747 3c64dd _memcpy_s 93742->93747 93746 3df4ea 48 API calls 93743->93746 93744 3df4ea 48 API calls 93745 3c64e4 93744->93745 93745->93660 93746->93747 93747->93744 93749 3cbe0d 93748->93749 93750 3cbe0a _memcpy_s 93748->93750 93751 3df4ea 48 API calls 93749->93751 93750->93741 93752 3cbe17 93751->93752 93754 3dee75 93752->93754 93756 3df4ea __calloc_impl 93754->93756 93755 3e395c __crtLCMapStringA_stat 47 API calls 93755->93756 93756->93755 93757 3df50c 93756->93757 93758 3df50e std::exception::exception 93756->93758 93757->93750 93763 3e6805 RaiseException 93758->93763 93760 3df538 93764 3e673b 47 API calls _free 93760->93764 93762 3df54a 93762->93750 93763->93760 93764->93762 93830 3c4214 93765->93830 93770 434f73 93773 3c4252 84 API calls 93770->93773 93771 3c41d4 LoadLibraryExW 93840 3c4291 93771->93840 93775 434f7a 93773->93775 93777 3c4291 3 API calls 93775->93777 93779 434f82 93777->93779 93778 3c41fb 93778->93779 93780 3c4207 93778->93780 93866 3c44ed 93779->93866 93781 3c4252 84 API calls 93780->93781 93783 3c39fe 93781->93783 93783->93665 93789 40c396 93783->93789 93786 434fa9 93874 3c4950 93786->93874 93788 434fb6 93790 3c4517 83 API calls 93789->93790 93791 40c405 93790->93791 94170 40c56d 93791->94170 93794 3c44ed 64 API calls 93795 40c432 93794->93795 93796 3c44ed 64 API calls 93795->93796 93797 40c442 93796->93797 93798 3c44ed 64 API calls 93797->93798 93799 40c45d 93798->93799 93800 3c44ed 64 API calls 93799->93800 93801 40c478 93800->93801 93802 3c4517 83 API calls 93801->93802 93803 40c48f 93802->93803 93804 3e395c __crtLCMapStringA_stat 47 API calls 93803->93804 93805 40c496 93804->93805 93806 3e395c __crtLCMapStringA_stat 47 API calls 93805->93806 93807 40c4a0 93806->93807 93808 3c44ed 64 API calls 93807->93808 93809 40c4b4 93808->93809 93810 40bf5a GetSystemTimeAsFileTime 93809->93810 93811 40c4c7 93810->93811 93812 40c4f1 93811->93812 93813 40c4dc 93811->93813 93814 40c556 93812->93814 93815 40c4f7 93812->93815 93816 3e1c9d _free 47 API calls 93813->93816 93818 3e1c9d _free 47 API calls 93814->93818 94176 40b965 93815->94176 93819 40c4e2 93816->93819 93821 40c41b 93818->93821 93822 3e1c9d _free 47 API calls 93819->93822 93821->93670 93824 3c4252 93821->93824 93822->93821 93823 3e1c9d _free 47 API calls 93823->93821 93825 3c425c 93824->93825 93826 3c4263 93824->93826 93827 3e35e4 __fcloseall 83 API calls 93825->93827 93828 3c4272 93826->93828 93829 3c4283 FreeLibrary 93826->93829 93827->93826 93828->93670 93829->93828 93879 3c4339 93830->93879 93834 3c41bb 93837 3e3499 93834->93837 93835 3c4244 FreeLibrary 93835->93834 93836 3c423c 93836->93834 93836->93835 93887 3e34ae 93837->93887 93839 3c41c8 93839->93770 93839->93771 93966 3c42e4 93840->93966 93843 3c42b8 93845 3c41ec 93843->93845 93846 3c42c1 FreeLibrary 93843->93846 93847 3c4380 93845->93847 93846->93845 93848 3df4ea 48 API calls 93847->93848 93849 3c4395 93848->93849 93974 3c47b7 93849->93974 93851 3c43a1 _memcpy_s 93852 3c43dc 93851->93852 93854 3c4499 93851->93854 93855 3c44d1 93851->93855 93853 3c4950 57 API calls 93852->93853 93859 3c43e5 93853->93859 93977 3c406b CreateStreamOnHGlobal 93854->93977 93988 40c750 93 API calls 93855->93988 93858 3c44ed 64 API calls 93858->93859 93859->93858 93861 3c4479 93859->93861 93862 434ed7 93859->93862 93983 3c4517 93859->93983 93861->93778 93863 3c4517 83 API calls 93862->93863 93864 434eeb 93863->93864 93865 3c44ed 64 API calls 93864->93865 93865->93861 93867 3c44ff 93866->93867 93870 434fc0 93866->93870 94012 3e381e 93867->94012 93871 40bf5a 94147 40bdb4 93871->94147 93873 40bf70 93873->93786 93875 3c495f 93874->93875 93878 435002 93874->93878 94152 3e3e65 93875->94152 93877 3c4967 93877->93788 93883 3c434b 93879->93883 93882 3c4321 LoadLibraryA GetProcAddress 93882->93836 93884 3c422f 93883->93884 93885 3c4354 LoadLibraryA 93883->93885 93884->93836 93884->93882 93885->93884 93886 3c4365 GetProcAddress 93885->93886 93886->93884 93890 3e34ba __wsopen_helper 93887->93890 93888 3e34cd 93935 3e7c0e 47 API calls __getptd_noexit 93888->93935 93890->93888 93892 3e34fe 93890->93892 93891 3e34d2 93936 3e6e10 8 API calls __wopenfile 93891->93936 93906 3ee4c8 93892->93906 93895 3e3503 93896 3e350c 93895->93896 93897 3e3519 93895->93897 93937 3e7c0e 47 API calls __getptd_noexit 93896->93937 93898 3e3543 93897->93898 93899 3e3523 93897->93899 93920 3ee5e0 93898->93920 93938 3e7c0e 47 API calls __getptd_noexit 93899->93938 93903 3e34dd __wsopen_helper @_EH4_CallFilterFunc@8 93903->93839 93907 3ee4d4 __wsopen_helper 93906->93907 93908 3e7cf4 __lock 47 API calls 93907->93908 93917 3ee4e2 93908->93917 93909 3ee559 93945 3e69d0 47 API calls __crtLCMapStringA_stat 93909->93945 93912 3ee5cc __wsopen_helper 93912->93895 93913 3ee560 93914 3ee56f InitializeCriticalSectionAndSpinCount EnterCriticalSection 93913->93914 93918 3ee552 93913->93918 93914->93918 93915 3e7d7c __mtinitlocknum 47 API calls 93915->93917 93917->93909 93917->93915 93917->93918 93943 3e4e5b 48 API calls __lock 93917->93943 93944 3e4ec5 LeaveCriticalSection LeaveCriticalSection _doexit 93917->93944 93940 3ee5d7 93918->93940 93929 3ee600 __wopenfile 93920->93929 93921 3ee61a 93950 3e7c0e 47 API calls __getptd_noexit 93921->93950 93923 3ee7d5 93923->93921 93927 3ee838 93923->93927 93924 3ee61f 93951 3e6e10 8 API calls __wopenfile 93924->93951 93926 3e354e 93939 3e3570 LeaveCriticalSection LeaveCriticalSection _fseek 93926->93939 93947 3f63c9 93927->93947 93929->93921 93929->93923 93929->93929 93952 3e185b 59 API calls 2 library calls 93929->93952 93931 3ee7ce 93931->93923 93953 3e185b 59 API calls 2 library calls 93931->93953 93933 3ee7ed 93933->93923 93954 3e185b 59 API calls 2 library calls 93933->93954 93935->93891 93936->93903 93937->93903 93938->93903 93939->93903 93946 3e7e58 LeaveCriticalSection 93940->93946 93942 3ee5de 93942->93912 93943->93917 93944->93917 93945->93913 93946->93942 93955 3f5bb1 93947->93955 93949 3f63e2 93949->93926 93950->93924 93951->93926 93952->93931 93953->93933 93954->93923 93956 3f5bbd __wsopen_helper 93955->93956 93957 3f5bcf 93956->93957 93960 3f5c06 93956->93960 93958 3e7c0e __wopenfile 47 API calls 93957->93958 93959 3f5bd4 93958->93959 93962 3e6e10 __wopenfile 8 API calls 93959->93962 93961 3f5c78 __wsopen_helper 110 API calls 93960->93961 93963 3f5c23 93961->93963 93965 3f5bde __wsopen_helper 93962->93965 93964 3f5c4c __wsopen_helper LeaveCriticalSection 93963->93964 93964->93965 93965->93949 93970 3c42f6 93966->93970 93969 3c42cc LoadLibraryA GetProcAddress 93969->93843 93971 3c42aa 93970->93971 93972 3c42ff LoadLibraryA 93970->93972 93971->93843 93971->93969 93972->93971 93973 3c4310 GetProcAddress 93972->93973 93973->93971 93975 3df4ea 48 API calls 93974->93975 93976 3c47c9 93975->93976 93976->93851 93978 3c4085 FindResourceExW 93977->93978 93982 3c40a2 93977->93982 93979 434f16 LoadResource 93978->93979 93978->93982 93980 434f2b SizeofResource 93979->93980 93979->93982 93981 434f3f LockResource 93980->93981 93980->93982 93981->93982 93982->93852 93984 3c4526 93983->93984 93987 434fe0 93983->93987 93989 3e3a8d 93984->93989 93986 3c4534 93986->93859 93988->93852 93990 3e3a99 __wsopen_helper 93989->93990 93991 3e3aa7 93990->93991 93993 3e3acd 93990->93993 94002 3e7c0e 47 API calls __getptd_noexit 93991->94002 94004 3e4e1c 93993->94004 93994 3e3aac 94003 3e6e10 8 API calls __wopenfile 93994->94003 93997 3e3ad3 94010 3e39fe 81 API calls 3 library calls 93997->94010 93999 3e3ae2 94011 3e3b04 LeaveCriticalSection LeaveCriticalSection _fseek 93999->94011 94001 3e3ab7 __wsopen_helper 94001->93986 94002->93994 94003->94001 94005 3e4e4e EnterCriticalSection 94004->94005 94006 3e4e2c 94004->94006 94008 3e4e44 94005->94008 94006->94005 94007 3e4e34 94006->94007 94009 3e7cf4 __lock 47 API calls 94007->94009 94008->93997 94009->94008 94010->93999 94011->94001 94015 3e3839 94012->94015 94014 3c4510 94014->93871 94016 3e3845 __wsopen_helper 94015->94016 94017 3e385b _memset 94016->94017 94018 3e3888 94016->94018 94020 3e3880 __wsopen_helper 94016->94020 94042 3e7c0e 47 API calls __getptd_noexit 94017->94042 94019 3e4e1c __lock_file 48 API calls 94018->94019 94021 3e388e 94019->94021 94020->94014 94028 3e365b 94021->94028 94024 3e3875 94043 3e6e10 8 API calls __wopenfile 94024->94043 94032 3e3676 _memset 94028->94032 94035 3e3691 94028->94035 94029 3e3681 94143 3e7c0e 47 API calls __getptd_noexit 94029->94143 94031 3e3686 94144 3e6e10 8 API calls __wopenfile 94031->94144 94032->94029 94032->94035 94039 3e36cf 94032->94039 94044 3e38c2 LeaveCriticalSection LeaveCriticalSection _fseek 94035->94044 94036 3e37e0 _memset 94146 3e7c0e 47 API calls __getptd_noexit 94036->94146 94039->94035 94039->94036 94045 3e2933 94039->94045 94052 3eee0e 94039->94052 94123 3eeb66 94039->94123 94145 3eec87 47 API calls 3 library calls 94039->94145 94042->94024 94043->94020 94044->94020 94046 3e293d 94045->94046 94047 3e2952 94045->94047 94048 3e7c0e __wopenfile 47 API calls 94046->94048 94047->94039 94049 3e2942 94048->94049 94050 3e6e10 __wopenfile 8 API calls 94049->94050 94051 3e294d 94050->94051 94051->94039 94053 3eee2f 94052->94053 94054 3eee46 94052->94054 94055 3e7bda __set_osfhnd 47 API calls 94053->94055 94056 3ef57e 94054->94056 94061 3eee80 94054->94061 94058 3eee34 94055->94058 94057 3e7bda __set_osfhnd 47 API calls 94056->94057 94059 3ef583 94057->94059 94060 3e7c0e __wopenfile 47 API calls 94058->94060 94062 3e7c0e __wopenfile 47 API calls 94059->94062 94066 3eee3b 94060->94066 94063 3eee88 94061->94063 94069 3eee9f 94061->94069 94065 3eee94 94062->94065 94064 3e7bda __set_osfhnd 47 API calls 94063->94064 94067 3eee8d 94064->94067 94068 3e6e10 __wopenfile 8 API calls 94065->94068 94066->94039 94071 3e7c0e __wopenfile 47 API calls 94067->94071 94068->94066 94069->94066 94070 3eeeb4 94069->94070 94073 3eeece 94069->94073 94074 3eeeec 94069->94074 94072 3e7bda __set_osfhnd 47 API calls 94070->94072 94071->94065 94072->94067 94073->94070 94075 3eeed9 94073->94075 94077 3e69d0 __malloc_crt 47 API calls 94074->94077 94079 3f3bf2 __flswbuf 47 API calls 94075->94079 94078 3eeefc 94077->94078 94080 3eef1f 94078->94080 94081 3eef04 94078->94081 94082 3eefed 94079->94082 94085 3ef82f __lseeki64_nolock 49 API calls 94080->94085 94083 3e7c0e __wopenfile 47 API calls 94081->94083 94084 3ef066 ReadFile 94082->94084 94089 3ef003 GetConsoleMode 94082->94089 94086 3eef09 94083->94086 94087 3ef088 94084->94087 94088 3ef546 GetLastError 94084->94088 94090 3eef2d 94085->94090 94091 3e7bda __set_osfhnd 47 API calls 94086->94091 94087->94088 94097 3ef058 94087->94097 94092 3ef046 94088->94092 94093 3ef553 94088->94093 94094 3ef017 94089->94094 94095 3ef063 94089->94095 94090->94075 94096 3eef14 94091->94096 94100 3e7bed __dosmaperr 47 API calls 94092->94100 94106 3ef04c 94092->94106 94098 3e7c0e __wopenfile 47 API calls 94093->94098 94094->94095 94099 3ef01d ReadConsoleW 94094->94099 94095->94084 94096->94066 94105 3ef32a 94097->94105 94097->94106 94108 3ef0bd 94097->94108 94101 3ef558 94098->94101 94099->94097 94102 3ef040 GetLastError 94099->94102 94100->94106 94103 3e7bda __set_osfhnd 47 API calls 94101->94103 94102->94092 94103->94106 94104 3e1c9d _free 47 API calls 94104->94066 94105->94106 94110 3ef430 ReadFile 94105->94110 94106->94066 94106->94104 94109 3ef129 ReadFile 94108->94109 94115 3ef1aa 94108->94115 94111 3ef14a GetLastError 94109->94111 94119 3ef154 94109->94119 94114 3ef453 GetLastError 94110->94114 94122 3ef461 94110->94122 94111->94119 94112 3ef267 94117 3ef217 MultiByteToWideChar 94112->94117 94118 3ef82f __lseeki64_nolock 49 API calls 94112->94118 94113 3ef257 94116 3e7c0e __wopenfile 47 API calls 94113->94116 94114->94122 94115->94106 94115->94112 94115->94113 94115->94117 94116->94106 94117->94102 94117->94106 94118->94117 94119->94108 94120 3ef82f __lseeki64_nolock 49 API calls 94119->94120 94120->94119 94121 3ef82f __lseeki64_nolock 49 API calls 94121->94122 94122->94105 94122->94121 94124 3eeb71 94123->94124 94127 3eeb86 94123->94127 94125 3e7c0e __wopenfile 47 API calls 94124->94125 94126 3eeb76 94125->94126 94128 3e6e10 __wopenfile 8 API calls 94126->94128 94129 3f3e24 __getbuf 47 API calls 94127->94129 94130 3eebbb 94127->94130 94137 3eeb81 94127->94137 94128->94137 94129->94130 94131 3e2933 __flush 47 API calls 94130->94131 94132 3eebcf 94131->94132 94133 3eed06 __filbuf 62 API calls 94132->94133 94134 3eebd6 94133->94134 94135 3e2933 __flush 47 API calls 94134->94135 94134->94137 94136 3eebf9 94135->94136 94136->94137 94138 3e2933 __flush 47 API calls 94136->94138 94137->94039 94139 3eec05 94138->94139 94139->94137 94140 3e2933 __flush 47 API calls 94139->94140 94141 3eec12 94140->94141 94142 3e2933 __flush 47 API calls 94141->94142 94142->94137 94143->94031 94144->94035 94145->94039 94146->94031 94150 3e344a GetSystemTimeAsFileTime 94147->94150 94149 40bdc3 94149->93873 94151 3e3478 __aulldiv 94150->94151 94151->94149 94153 3e3e71 __wsopen_helper 94152->94153 94154 3e3e7f 94153->94154 94155 3e3e94 94153->94155 94166 3e7c0e 47 API calls __getptd_noexit 94154->94166 94157 3e4e1c __lock_file 48 API calls 94155->94157 94159 3e3e9a 94157->94159 94158 3e3e84 94167 3e6e10 8 API calls __wopenfile 94158->94167 94168 3e3b0c 55 API calls 5 library calls 94159->94168 94162 3e3ea5 94169 3e3ec5 LeaveCriticalSection LeaveCriticalSection _fseek 94162->94169 94164 3e3eb7 94165 3e3e8f __wsopen_helper 94164->94165 94165->93877 94166->94158 94167->94165 94168->94162 94169->94164 94171 40c581 __tzset_nolock _wcscmp 94170->94171 94172 40c417 94171->94172 94173 3c44ed 64 API calls 94171->94173 94174 40bf5a GetSystemTimeAsFileTime 94171->94174 94175 3c4517 83 API calls 94171->94175 94172->93794 94172->93821 94173->94171 94174->94171 94175->94171 94177 40b970 94176->94177 94178 40b97e 94176->94178 94179 3e3499 117 API calls 94177->94179 94180 40b9c3 94178->94180 94181 3e3499 117 API calls 94178->94181 94206 40b987 94178->94206 94179->94178 94207 40bbe8 94180->94207 94183 40b9a8 94181->94183 94183->94180 94186 40b9b1 94183->94186 94184 40ba07 94185 40ba2c 94184->94185 94187 40ba0b 94184->94187 94211 40b7e5 94185->94211 94189 3e35e4 __fcloseall 83 API calls 94186->94189 94186->94206 94188 40ba18 94187->94188 94191 3e35e4 __fcloseall 83 API calls 94187->94191 94193 3e35e4 __fcloseall 83 API calls 94188->94193 94188->94206 94189->94206 94191->94188 94193->94206 94194 40ba5a 94220 40ba8a 94194->94220 94195 40ba3a 94197 40ba47 94195->94197 94198 3e35e4 __fcloseall 83 API calls 94195->94198 94200 3e35e4 __fcloseall 83 API calls 94197->94200 94197->94206 94198->94197 94200->94206 94203 40ba75 94205 3e35e4 __fcloseall 83 API calls 94203->94205 94203->94206 94205->94206 94206->93823 94208 40bbf6 _memcpy_s __tzset_nolock 94207->94208 94209 40bc0d 94207->94209 94208->94184 94210 3e381e __fread_nolock 64 API calls 94209->94210 94210->94208 94212 3e395c __crtLCMapStringA_stat 47 API calls 94211->94212 94213 40b7f4 94212->94213 94214 3e395c __crtLCMapStringA_stat 47 API calls 94213->94214 94215 40b808 94214->94215 94216 3e395c __crtLCMapStringA_stat 47 API calls 94215->94216 94217 40b81c 94216->94217 94218 40bb64 47 API calls 94217->94218 94219 40b82f 94217->94219 94218->94219 94219->94194 94219->94195 94227 40baa0 94220->94227 94221 40bb51 94253 40bd8a 94221->94253 94223 40ba61 94228 40bb64 94223->94228 94225 40b841 64 API calls 94225->94227 94227->94221 94227->94223 94227->94225 94249 40bc67 94227->94249 94257 40b942 64 API calls 94227->94257 94229 40bb71 94228->94229 94231 40bb77 94228->94231 94230 3e1c9d _free 47 API calls 94229->94230 94230->94231 94232 40bb88 94231->94232 94233 3e1c9d _free 47 API calls 94231->94233 94234 40ba68 94232->94234 94235 3e1c9d _free 47 API calls 94232->94235 94233->94232 94234->94203 94236 3e35e4 94234->94236 94235->94234 94237 3e35f0 __wsopen_helper 94236->94237 94238 3e361c 94237->94238 94239 3e3604 94237->94239 94242 3e4e1c __lock_file 48 API calls 94238->94242 94245 3e3614 __wsopen_helper 94238->94245 94291 3e7c0e 47 API calls __getptd_noexit 94239->94291 94241 3e3609 94292 3e6e10 8 API calls __wopenfile 94241->94292 94244 3e362e 94242->94244 94275 3e3578 94244->94275 94245->94203 94250 40bcb6 94249->94250 94251 40bc76 94249->94251 94250->94251 94258 40bd3d 94250->94258 94251->94227 94254 40bda8 94253->94254 94255 40bd97 94253->94255 94254->94223 94256 3e2aae 80 API calls 94255->94256 94256->94254 94257->94227 94259 40bd7a 94258->94259 94260 40bd69 94258->94260 94259->94250 94262 3e2aae 94260->94262 94263 3e2aba __wsopen_helper 94262->94263 94264 3e2ae4 __wsopen_helper 94263->94264 94265 3e2aec 94263->94265 94266 3e2ad4 94263->94266 94264->94259 94267 3e4e1c __lock_file 48 API calls 94265->94267 94268 3e7c0e __wopenfile 47 API calls 94266->94268 94269 3e2af2 94267->94269 94270 3e2ad9 94268->94270 94271 3e2957 78 API calls 94269->94271 94272 3e6e10 __wopenfile 8 API calls 94270->94272 94273 3e2b06 94271->94273 94272->94264 94274 3e2b24 LeaveCriticalSection LeaveCriticalSection 94273->94274 94274->94264 94276 3e359b 94275->94276 94277 3e3587 94275->94277 94279 3e3597 94276->94279 94294 3e2c84 94276->94294 94327 3e7c0e 47 API calls __getptd_noexit 94277->94327 94293 3e3653 LeaveCriticalSection LeaveCriticalSection _fseek 94279->94293 94280 3e358c 94328 3e6e10 8 API calls __wopenfile 94280->94328 94286 3e2933 __flush 47 API calls 94287 3e35b5 94286->94287 94304 3ee9d2 94287->94304 94289 3e35bb 94289->94279 94290 3e1c9d _free 47 API calls 94289->94290 94290->94279 94291->94241 94292->94245 94293->94245 94295 3e2cbb 94294->94295 94296 3e2c97 94294->94296 94300 3eeb36 94295->94300 94296->94295 94297 3e2933 __flush 47 API calls 94296->94297 94298 3e2cb4 94297->94298 94329 3eaf61 94298->94329 94301 3e35af 94300->94301 94302 3eeb43 94300->94302 94301->94286 94302->94301 94303 3e1c9d _free 47 API calls 94302->94303 94303->94301 94305 3ee9de __wsopen_helper 94304->94305 94306 3ee9fe 94305->94306 94307 3ee9e6 94305->94307 94309 3eea7b 94306->94309 94312 3eea28 94306->94312 94378 3e7bda 47 API calls __getptd_noexit 94307->94378 94382 3e7bda 47 API calls __getptd_noexit 94309->94382 94310 3ee9eb 94379 3e7c0e 47 API calls __getptd_noexit 94310->94379 94354 3ea8ed 94312->94354 94314 3eea80 94383 3e7c0e 47 API calls __getptd_noexit 94314->94383 94317 3eea88 94384 3e6e10 8 API calls __wopenfile 94317->94384 94318 3eea2e 94320 3eea4c 94318->94320 94321 3eea41 94318->94321 94380 3e7c0e 47 API calls __getptd_noexit 94320->94380 94363 3eea9c 94321->94363 94324 3eea47 94381 3eea73 LeaveCriticalSection __unlock_fhandle 94324->94381 94325 3ee9f3 __wsopen_helper 94325->94289 94327->94280 94328->94279 94330 3eaf6d __wsopen_helper 94329->94330 94331 3eaf8d 94330->94331 94332 3eaf75 94330->94332 94334 3eb022 94331->94334 94337 3eafbf 94331->94337 94333 3e7bda __set_osfhnd 47 API calls 94332->94333 94336 3eaf7a 94333->94336 94335 3e7bda __set_osfhnd 47 API calls 94334->94335 94338 3eb027 94335->94338 94339 3e7c0e __wopenfile 47 API calls 94336->94339 94340 3ea8ed ___lock_fhandle 49 API calls 94337->94340 94341 3e7c0e __wopenfile 47 API calls 94338->94341 94347 3eaf82 __wsopen_helper 94339->94347 94342 3eafc5 94340->94342 94343 3eb02f 94341->94343 94344 3eafeb 94342->94344 94345 3eafd8 94342->94345 94346 3e6e10 __wopenfile 8 API calls 94343->94346 94349 3e7c0e __wopenfile 47 API calls 94344->94349 94348 3eb043 __chsize_nolock 75 API calls 94345->94348 94346->94347 94347->94295 94350 3eafe4 94348->94350 94351 3eaff0 94349->94351 94353 3eb01a __flush LeaveCriticalSection 94350->94353 94352 3e7bda __set_osfhnd 47 API calls 94351->94352 94352->94350 94353->94347 94355 3ea8f9 __wsopen_helper 94354->94355 94356 3ea946 EnterCriticalSection 94355->94356 94357 3e7cf4 __lock 47 API calls 94355->94357 94358 3ea96c __wsopen_helper 94356->94358 94359 3ea91d 94357->94359 94358->94318 94360 3ea93a 94359->94360 94361 3ea928 InitializeCriticalSectionAndSpinCount 94359->94361 94362 3ea970 ___lock_fhandle LeaveCriticalSection 94360->94362 94361->94360 94362->94356 94364 3eaba4 __lseeki64_nolock 47 API calls 94363->94364 94367 3eeaaa 94364->94367 94365 3eeb00 94366 3eab1e __free_osfhnd 48 API calls 94365->94366 94369 3eeb08 94366->94369 94367->94365 94370 3eaba4 __lseeki64_nolock 47 API calls 94367->94370 94377 3eeade 94367->94377 94368 3eaba4 __lseeki64_nolock 47 API calls 94371 3eeaea CloseHandle 94368->94371 94374 3e7bed __dosmaperr 47 API calls 94369->94374 94375 3eeb2a 94369->94375 94372 3eead5 94370->94372 94371->94365 94373 3eeaf6 GetLastError 94371->94373 94376 3eaba4 __lseeki64_nolock 47 API calls 94372->94376 94373->94365 94374->94375 94375->94324 94376->94377 94377->94365 94377->94368 94378->94310 94379->94325 94380->94324 94381->94325 94382->94314 94383->94317 94384->94325 94385->93676 94386->93683 94387->93694 94388->93694 94389->93693 94390->93708 94391->93710 94392->93706 94393->93714 94394->93720 94395->93733 94396->93726 94456 3ef8a0 94397->94456 94400 3c6a63 48 API calls 94401 3c6643 94400->94401 94458 3c6571 94401->94458 94404 3c40a7 94405 3ef8a0 __ftell_nolock 94404->94405 94406 3c40b4 GetLongPathNameW 94405->94406 94407 3c6a63 48 API calls 94406->94407 94408 3c40dc 94407->94408 94409 3c49a0 94408->94409 94410 3cd7f7 48 API calls 94409->94410 94411 3c49b2 94410->94411 94412 3c660f 49 API calls 94411->94412 94413 3c49bd 94412->94413 94414 3c49c8 94413->94414 94417 432e35 94413->94417 94416 3c64cf 48 API calls 94414->94416 94418 3c49d4 94416->94418 94419 432e4f 94417->94419 94472 3dd35e 60 API calls 94417->94472 94466 3c28a6 94418->94466 94421 3c49e7 Mailbox 94421->93470 94423 3c41a9 136 API calls 94422->94423 94424 3c415e 94423->94424 94425 433489 94424->94425 94426 3c41a9 136 API calls 94424->94426 94427 40c396 122 API calls 94425->94427 94428 3c4172 94426->94428 94429 43349e 94427->94429 94428->94425 94430 3c417a 94428->94430 94431 4334a2 94429->94431 94432 4334bf 94429->94432 94434 4334aa 94430->94434 94435 3c4186 94430->94435 94436 3c4252 84 API calls 94431->94436 94433 3df4ea 48 API calls 94432->94433 94455 433504 Mailbox 94433->94455 94575 406b49 87 API calls _wprintf 94434->94575 94473 3cc833 94435->94473 94436->94434 94440 4334b8 94440->94432 94441 4336b4 94442 3e1c9d _free 47 API calls 94441->94442 94443 4336bc 94442->94443 94444 3c4252 84 API calls 94443->94444 94449 4336c5 94444->94449 94448 3e1c9d _free 47 API calls 94448->94449 94449->94448 94450 3c4252 84 API calls 94449->94450 94579 4025b5 86 API calls 4 library calls 94449->94579 94450->94449 94452 3cce19 48 API calls 94452->94455 94455->94441 94455->94449 94455->94452 94561 3cba85 94455->94561 94569 3c4dd9 94455->94569 94576 402551 48 API calls _memcpy_s 94455->94576 94577 402472 60 API calls 2 library calls 94455->94577 94578 409c12 48 API calls 94455->94578 94457 3c661c GetFullPathNameW 94456->94457 94457->94400 94459 3c657f 94458->94459 94462 3cb18b 94459->94462 94461 3c4114 94461->94404 94463 3cb199 94462->94463 94465 3cb1a2 _memcpy_s 94462->94465 94464 3cbdfa 48 API calls 94463->94464 94463->94465 94464->94465 94465->94461 94467 3c28b8 94466->94467 94471 3c28d7 _memcpy_s 94466->94471 94469 3df4ea 48 API calls 94467->94469 94468 3df4ea 48 API calls 94470 3c28ee 94468->94470 94469->94471 94470->94421 94471->94468 94472->94417 94474 3cc843 __ftell_nolock 94473->94474 94475 433095 94474->94475 94476 3cc860 94474->94476 94604 4025b5 86 API calls 4 library calls 94475->94604 94585 3c48ba 49 API calls 94476->94585 94479 4330a8 94605 4025b5 86 API calls 4 library calls 94479->94605 94480 3cc882 94586 3c4550 56 API calls 94480->94586 94482 3cc897 94482->94479 94484 3cc89f 94482->94484 94486 3cd7f7 48 API calls 94484->94486 94485 4330c4 94488 3cc90c 94485->94488 94487 3cc8ab 94486->94487 94587 3de968 49 API calls __ftell_nolock 94487->94587 94490 4330d7 94488->94490 94491 3cc91a 94488->94491 94494 3c4907 CloseHandle 94490->94494 94590 3e1dfc 94491->94590 94492 3cc8b7 94495 3cd7f7 48 API calls 94492->94495 94496 4330e3 94494->94496 94497 3cc8c3 94495->94497 94498 3c41a9 136 API calls 94496->94498 94499 3c660f 49 API calls 94497->94499 94500 43310d 94498->94500 94501 3cc8d1 94499->94501 94504 433136 94500->94504 94508 40c396 122 API calls 94500->94508 94588 3deb66 SetFilePointerEx ReadFile 94501->94588 94503 3cc943 _wcscat _wcscpy 94507 3cc96d SetCurrentDirectoryW 94503->94507 94606 4025b5 86 API calls 4 library calls 94504->94606 94505 3cc8fd 94589 3c46ce SetFilePointerEx SetFilePointerEx 94505->94589 94511 3df4ea 48 API calls 94507->94511 94512 433129 94508->94512 94510 43314d 94520 3ccad1 Mailbox 94510->94520 94513 3cc988 94511->94513 94514 433152 94512->94514 94515 433131 94512->94515 94518 3c47b7 48 API calls 94513->94518 94517 3c4252 84 API calls 94514->94517 94516 3c4252 84 API calls 94515->94516 94516->94504 94519 433157 94517->94519 94547 3cc993 Mailbox __wsetenvp 94518->94547 94521 3df4ea 48 API calls 94519->94521 94580 3c48dd 94520->94580 94528 433194 94521->94528 94522 3cca9d 94600 3c4907 94522->94600 94526 3c3d98 94526->93331 94526->93340 94527 3ccaa9 SetCurrentDirectoryW 94527->94520 94530 3cba85 48 API calls 94528->94530 94534 4331dd Mailbox 94530->94534 94532 4333ce 94611 409b72 48 API calls 94532->94611 94533 433467 94615 4025b5 86 API calls 4 library calls 94533->94615 94534->94532 94548 3cba85 48 API calls 94534->94548 94553 3cce19 48 API calls 94534->94553 94556 433420 94534->94556 94607 402551 48 API calls _memcpy_s 94534->94607 94608 402472 60 API calls 2 library calls 94534->94608 94609 409c12 48 API calls 94534->94609 94610 3dc682 48 API calls 94534->94610 94538 433480 94538->94522 94539 4333f0 94612 4229e8 48 API calls _memcpy_s 94539->94612 94541 4333fd 94543 3e1c9d _free 47 API calls 94541->94543 94542 43345f 94614 40240b 48 API calls 3 library calls 94542->94614 94543->94520 94545 3cce19 48 API calls 94545->94547 94547->94522 94547->94533 94547->94542 94547->94545 94593 3cb337 56 API calls _wcscpy 94547->94593 94594 3dc258 GetStringTypeW 94547->94594 94595 3ccb93 59 API calls __wcsnicmp 94547->94595 94596 3ccb5a GetStringTypeW __wsetenvp 94547->94596 94597 3e16d0 GetStringTypeW __wtof_l 94547->94597 94598 3ccc24 162 API calls 3 library calls 94547->94598 94599 3dc682 48 API calls 94547->94599 94548->94534 94553->94534 94613 4025b5 86 API calls 4 library calls 94556->94613 94558 433439 94559 3e1c9d _free 47 API calls 94558->94559 94560 43344c 94559->94560 94560->94520 94562 3cba98 _memcpy_s 94561->94562 94563 3cbb25 94561->94563 94564 3df4ea 48 API calls 94562->94564 94565 3df4ea 48 API calls 94563->94565 94566 3cba9f 94564->94566 94565->94562 94567 3df4ea 48 API calls 94566->94567 94568 3cbac8 94566->94568 94567->94568 94568->94455 94571 3c4dec 94569->94571 94574 3c4e9a 94569->94574 94570 3c4e1e 94573 3df4ea 48 API calls 94570->94573 94570->94574 94571->94570 94572 3df4ea 48 API calls 94571->94572 94572->94570 94573->94570 94574->94455 94575->94440 94576->94455 94577->94455 94578->94455 94579->94449 94581 3c4907 CloseHandle 94580->94581 94582 3c48e5 Mailbox 94581->94582 94583 3c4907 CloseHandle 94582->94583 94584 3c48fc 94583->94584 94584->94526 94585->94480 94586->94482 94587->94492 94588->94505 94589->94488 94616 3e1e46 94590->94616 94593->94547 94594->94547 94595->94547 94596->94547 94597->94547 94598->94547 94599->94547 94601 3c4920 94600->94601 94602 3c4911 94600->94602 94601->94602 94603 3c4925 CloseHandle 94601->94603 94602->94527 94603->94602 94604->94479 94605->94485 94606->94510 94607->94534 94608->94534 94609->94534 94610->94534 94611->94539 94612->94541 94613->94558 94614->94533 94615->94538 94617 3e1e61 94616->94617 94621 3e1e55 94616->94621 94640 3e7c0e 47 API calls __getptd_noexit 94617->94640 94619 3e2019 94625 3e1e41 94619->94625 94641 3e6e10 8 API calls __wopenfile 94619->94641 94621->94617 94627 3e1ed4 94621->94627 94635 3e9d6b 47 API calls __wopenfile 94621->94635 94623 3e1fa0 94623->94617 94623->94625 94628 3e1fb0 94623->94628 94624 3e1f5f 94624->94617 94626 3e1f7b 94624->94626 94637 3e9d6b 47 API calls __wopenfile 94624->94637 94625->94503 94626->94617 94626->94625 94631 3e1f91 94626->94631 94627->94617 94634 3e1f41 94627->94634 94636 3e9d6b 47 API calls __wopenfile 94627->94636 94639 3e9d6b 47 API calls __wopenfile 94628->94639 94638 3e9d6b 47 API calls __wopenfile 94631->94638 94634->94623 94634->94624 94635->94627 94636->94634 94637->94626 94638->94625 94639->94625 94640->94619 94641->94625 94643 3df4ea 48 API calls 94642->94643 94644 3c6b54 94643->94644 94644->93482 94645->93481 94647 3c4c8b 94646->94647 94652 3c4d94 94646->94652 94648 3df4ea 48 API calls 94647->94648 94647->94652 94649 3c4cb2 94648->94649 94650 3df4ea 48 API calls 94649->94650 94656 3c4d22 94650->94656 94652->93487 94654 3c4dd9 48 API calls 94654->94656 94655 3cba85 48 API calls 94655->94656 94656->94652 94656->94654 94656->94655 94659 3cb470 94656->94659 94687 409af1 48 API calls 94656->94687 94657->93489 94658->93491 94688 3c6b0f 94659->94688 94661 3cb69b 94662 3cba85 48 API calls 94661->94662 94663 3cb6b5 Mailbox 94662->94663 94663->94656 94666 3cb495 94666->94661 94667 433939 _memcpy_s 94666->94667 94668 43397b 94666->94668 94671 3cb9e4 94666->94671 94674 3cba85 48 API calls 94666->94674 94677 3cbcce 48 API calls 94666->94677 94679 433909 94666->94679 94684 3cbdfa 48 API calls 94666->94684 94693 3cc413 59 API calls 94666->94693 94694 3cbb85 94666->94694 94699 3cbc74 48 API calls 94666->94699 94700 3cc6a5 49 API calls 94666->94700 94701 3cc799 48 API calls _memcpy_s 94666->94701 94702 4026bc 88 API calls 4 library calls 94667->94702 94703 4026bc 88 API calls 4 library calls 94668->94703 94704 4026bc 88 API calls 4 library calls 94671->94704 94673 433973 94673->94663 94674->94666 94676 433989 94678 3cba85 48 API calls 94676->94678 94677->94666 94678->94673 94681 3c6b4a 48 API calls 94679->94681 94682 433914 94681->94682 94686 3df4ea 48 API calls 94682->94686 94685 3cb66c CharUpperBuffW 94684->94685 94685->94666 94686->94667 94687->94656 94689 3df4ea 48 API calls 94688->94689 94690 3c6b34 94689->94690 94691 3c6b4a 48 API calls 94690->94691 94692 3c6b43 94691->94692 94692->94666 94693->94666 94695 3cbb9b 94694->94695 94698 3cbb96 _memcpy_s 94694->94698 94696 431b77 94695->94696 94697 3dee75 48 API calls 94695->94697 94697->94698 94698->94666 94699->94666 94700->94666 94701->94666 94702->94673 94703->94676 94704->94673 94706 3c403c LoadImageW 94705->94706 94707 43418d EnumResourceNamesW 94705->94707 94708 3c3ee1 RegisterClassExW 94706->94708 94707->94708 94709 3c3f53 7 API calls 94708->94709 94709->93506 94711 433c33 94710->94711 94712 3c4c44 94710->94712 94711->94712 94713 433c3c DestroyIcon 94711->94713 94712->93512 94736 405819 61 API calls _W_store_winword 94712->94736 94713->94712 94715 3c51cb 94714->94715 94735 3c52a2 Mailbox 94714->94735 94716 3c6b0f 48 API calls 94715->94716 94717 3c51d9 94716->94717 94718 433ca1 LoadStringW 94717->94718 94719 3c51e6 94717->94719 94722 433cbb 94718->94722 94720 3c6a63 48 API calls 94719->94720 94721 3c51fb 94720->94721 94721->94722 94724 3c510d 48 API calls 94722->94724 94735->93517 94736->93512 94738 3cef1d 94737->94738 94739 3cef2f 94737->94739 94738->93578 94947 40cc5c 86 API calls 4 library calls 94739->94947 94741 4386f9 94741->94741 94743 3cf130 94742->94743 94744 3cf199 94743->94744 94746 3cfe30 335 API calls 94743->94746 94745 3cf595 94744->94745 94755 3cd7f7 48 API calls 94744->94755 94784 3cf229 94744->94784 94795 3cf3dd 94744->94795 94751 3cd7f7 48 API calls 94745->94751 94789 3cf431 Mailbox 94745->94789 94748 438728 94746->94748 94747 4387c8 94952 40cc5c 86 API calls 4 library calls 94747->94952 94748->94744 94949 40cc5c 86 API calls 4 library calls 94748->94949 94749 3cfe30 335 API calls 94749->94789 94754 4387a3 94751->94754 94753 3cf3f2 94788 3cf418 94753->94788 94953 409af1 48 API calls 94753->94953 94951 3e0f0a 52 API calls __cinit 94754->94951 94757 438772 94755->94757 94756 438b1b 94773 438bcf 94756->94773 94774 438b2c 94756->94774 94950 3e0f0a 52 API calls __cinit 94757->94950 94759 3cf770 94763 438a45 94759->94763 94782 3cf77a 94759->94782 94761 3cd6e9 55 API calls 94761->94789 94959 3dc1af 48 API calls 94763->94959 94764 438c53 94967 40cc5c 86 API calls 4 library calls 94764->94967 94765 438810 94954 41eef8 335 API calls 94765->94954 94766 3cfe30 335 API calls 94785 3cf6aa 94766->94785 94767 40cc5c 86 API calls 94767->94789 94768 438b7e 94962 41e40a 335 API calls Mailbox 94768->94962 94964 40cc5c 86 API calls 4 library calls 94773->94964 94961 41f5ee 335 API calls 94774->94961 94775 438beb 94965 41bdbd 335 API calls Mailbox 94775->94965 94777 3d1b90 48 API calls 94777->94789 94780 3d1b90 48 API calls 94780->94789 94782->94777 94783 438c00 94805 3cf537 Mailbox 94783->94805 94966 40cc5c 86 API calls 4 library calls 94783->94966 94784->94745 94784->94788 94784->94789 94784->94795 94785->94759 94785->94766 94786 3cfce0 94785->94786 94785->94789 94785->94805 94786->94805 94963 40cc5c 86 API calls 4 library calls 94786->94963 94788->94756 94788->94785 94788->94789 94789->94749 94789->94761 94789->94764 94789->94767 94789->94768 94789->94775 94789->94780 94789->94786 94789->94805 94948 3cdd47 48 API calls _memcpy_s 94789->94948 94960 3f97ed InterlockedDecrement 94789->94960 94968 3dc1af 48 API calls 94789->94968 94790 438823 94790->94788 94793 43884b 94790->94793 94795->94747 94795->94753 94795->94789 94805->93578 94808 3d479f 94807->94808 94809 3d4637 94807->94809 94810 3cce19 48 API calls 94808->94810 94811 436e05 94809->94811 94812 3d4643 94809->94812 94819 3d46e4 Mailbox 94810->94819 95023 41e822 94811->95023 95022 3d4300 335 API calls _memcpy_s 94812->95022 94815 3d4739 Mailbox 94815->93578 94816 436e11 94816->94815 95063 40cc5c 86 API calls 4 library calls 94816->95063 94818 3d4659 94818->94815 94818->94816 94818->94819 94823 3c4252 84 API calls 94819->94823 94969 406524 94819->94969 94972 40fa0c 94819->94972 95013 416ff0 94819->95013 94823->94815 94826 43df42 94824->94826 94828 3de253 94824->94828 94825 43df77 94826->94825 94827 43df59 TranslateAcceleratorW 94826->94827 94827->94828 94828->93578 94830 3ddca3 94829->94830 94831 3ddc71 94829->94831 94830->93578 94831->94830 94832 3ddc96 IsDialogMessageW 94831->94832 94833 43dd1d GetClassLongW 94831->94833 94832->94830 94832->94831 94833->94831 94833->94832 94834->93578 95167 3cbd30 94835->95167 94837 3d3267 94838 3d3628 94837->94838 94839 3d32f8 94837->94839 94840 43907a 94837->94840 94841 3d3635 Mailbox 94838->94841 95184 40cc5c 86 API calls 4 library calls 94838->95184 95179 3dc36b 86 API calls 94839->95179 95185 40cc5c 86 API calls 4 library calls 94840->95185 94841->93578 94845 4394df 94845->94838 95202 40cc5c 86 API calls 4 library calls 94845->95202 94847 4391fa 94848 3dc3c3 48 API calls 94889 3d34eb _memcpy_s Mailbox 94848->94889 94849 3d3313 94849->94838 94849->94845 94849->94889 95172 3c2b7a 94849->95172 94853 43926d 95194 40cc5c 86 API calls 4 library calls 94853->95194 94854 43909a 94854->94847 94857 3cd645 53 API calls 94854->94857 94873 439438 95199 40cc5c 86 API calls 4 library calls 94873->95199 94875 3cfe30 335 API calls 94875->94889 94882 3d351f 94896 3c6eed 48 API calls 94882->94896 94889->94838 94889->94848 94889->94853 94889->94854 94889->94873 94889->94875 94889->94882 94891 3df4ea 48 API calls 94889->94891 94897 439394 94889->94897 94902 4393c5 94889->94902 95181 3cd9a0 53 API calls __cinit 94889->95181 95182 3cd8c0 53 API calls 94889->95182 95183 3dc2d6 48 API calls _memcpy_s 94889->95183 95195 41cda2 82 API calls Mailbox 94889->95195 95196 4080e3 53 API calls 94889->95196 95197 3cd764 55 API calls 94889->95197 95198 3cdcae 50 API calls Mailbox 94889->95198 94891->94889 94907->93532 94908->93524 94909->93529 94910->93578 94911->93578 94912->93573 94913->93573 94914->93573 94916 3cfe50 94915->94916 94939 3cfe7e 94915->94939 94917 3df4ea 48 API calls 94916->94917 94917->94939 94918 3d146e 94919 3c6eed 48 API calls 94918->94919 94941 3cffe1 94919->94941 94920 3cd7f7 48 API calls 94920->94939 94922 3d0509 95209 40cc5c 86 API calls 4 library calls 94922->95209 94924 3e0f0a 52 API calls __cinit 94924->94939 94925 3c6eed 48 API calls 94925->94939 94927 3df4ea 48 API calls 94927->94939 94928 3d1473 95208 40cc5c 86 API calls 4 library calls 94928->95208 94929 43a246 94933 3c6eed 48 API calls 94929->94933 94930 43a922 94930->93578 94933->94941 94934 43a873 94934->93578 94935 43a30e 94935->94941 95206 3f97ed InterlockedDecrement 94935->95206 94936 3f97ed InterlockedDecrement 94936->94939 94938 43a973 95210 40cc5c 86 API calls 4 library calls 94938->95210 94939->94918 94939->94920 94939->94922 94939->94924 94939->94925 94939->94927 94939->94928 94939->94929 94939->94935 94939->94936 94939->94938 94939->94941 94943 3d15b5 94939->94943 95204 3d1820 335 API calls 2 library calls 94939->95204 95205 3d1d10 59 API calls Mailbox 94939->95205 94941->93578 94942 43a982 95207 40cc5c 86 API calls 4 library calls 94943->95207 94944->93573 94945->93573 94946->93573 94947->94741 94948->94789 94949->94744 94950->94784 94951->94789 94952->94805 94953->94765 94954->94790 94959->94789 94960->94789 94961->94789 94962->94786 94963->94805 94964->94805 94965->94783 94966->94805 94967->94805 94968->94789 95064 406ca9 GetFileAttributesW 94969->95064 94973 40fa1c __ftell_nolock 94972->94973 94974 40fa44 94973->94974 95149 3cd286 48 API calls 94973->95149 95068 3c936c 94974->95068 95014 3c936c 81 API calls 95013->95014 95015 41702a 95014->95015 95016 3cb470 91 API calls 95015->95016 95017 41703a 95016->95017 95022->94818 95024 41e868 95023->95024 95025 41e84e 95023->95025 95160 41ccdc 48 API calls 95024->95160 95159 40cc5c 86 API calls 4 library calls 95025->95159 95028 41e871 95029 3cfe30 334 API calls 95028->95029 95030 41e8cf 95029->95030 95056 41e860 Mailbox 95030->95056 95056->94816 95063->94815 95065 406529 95064->95065 95066 406cc4 FindFirstFileW 95064->95066 95065->94815 95066->95065 95067 406cd9 FindClose 95066->95067 95067->95065 95069 3c9384 95068->95069 95079 3c9380 95068->95079 95070 434cbd __i64tow 95069->95070 95071 3c9398 95069->95071 95072 434bbf 95069->95072 95081 3c93b0 __itow Mailbox _wcscpy 95069->95081 95149->94974 95159->95056 95160->95028 95168 3cbd3f 95167->95168 95171 3cbd5a 95167->95171 95169 3cbdfa 48 API calls 95168->95169 95170 3cbd47 CharUpperBuffW 95169->95170 95170->95171 95171->94837 95173 3c2b8b 95172->95173 95174 43436a 95172->95174 95175 3df4ea 48 API calls 95173->95175 95179->94849 95181->94889 95182->94889 95183->94889 95184->94841 95185->94849 95194->94838 95195->94889 95196->94889 95197->94889 95198->94889 95199->94838 95202->94838 95204->94939 95205->94939 95206->94941 95207->94941 95208->94934 95209->94930 95210->94942 95231 439c06 95242 3dd3be 95231->95242 95233 439c1c 95234 439c91 Mailbox 95233->95234 95251 3c1caa 49 API calls 95233->95251 95236 3d3200 335 API calls 95234->95236 95237 439cc5 95236->95237 95241 43a7ab Mailbox 95237->95241 95253 40cc5c 86 API calls 4 library calls 95237->95253 95239 439c71 95239->95237 95252 40b171 48 API calls 95239->95252 95243 3dd3dc 95242->95243 95244 3dd3ca 95242->95244 95246 3dd40b 95243->95246 95247 3dd3e2 95243->95247 95254 3cdcae 50 API calls Mailbox 95244->95254 95255 3cdcae 50 API calls Mailbox 95246->95255 95248 3df4ea 48 API calls 95247->95248 95250 3dd3d4 95248->95250 95250->95233 95251->95239 95252->95234 95253->95241 95254->95250 95255->95250 95256 43197b 95261 3ddd94 95256->95261 95260 43198a 95262 3df4ea 48 API calls 95261->95262 95263 3ddd9c 95262->95263 95264 3dddb0 95263->95264 95269 3ddf3d 95263->95269 95268 3e0f0a 52 API calls __cinit 95264->95268 95268->95260 95270 3ddda8 95269->95270 95271 3ddf46 95269->95271 95273 3dddc0 95270->95273 95301 3e0f0a 52 API calls __cinit 95271->95301 95274 3cd7f7 48 API calls 95273->95274 95275 3dddd7 GetVersionExW 95274->95275 95276 3c6a63 48 API calls 95275->95276 95277 3dde1a 95276->95277 95302 3ddfb4 95277->95302 95280 3c6571 48 API calls 95283 3dde2e 95280->95283 95282 4324c8 95283->95282 95306 3ddf77 95283->95306 95285 3ddea4 GetCurrentProcess 95315 3ddf5f LoadLibraryA GetProcAddress 95285->95315 95286 3ddebb 95287 3ddf31 GetSystemInfo 95286->95287 95288 3ddee3 95286->95288 95290 3ddf0e 95287->95290 95309 3de00c 95288->95309 95293 3ddf1c FreeLibrary 95290->95293 95294 3ddf21 95290->95294 95293->95294 95294->95264 95295 3ddf29 GetSystemInfo 95297 3ddf03 95295->95297 95296 3ddef9 95312 3ddff4 95296->95312 95297->95290 95300 3ddf09 FreeLibrary 95297->95300 95300->95290 95301->95270 95303 3ddfbd 95302->95303 95304 3cb18b 48 API calls 95303->95304 95305 3dde22 95304->95305 95305->95280 95316 3ddf89 95306->95316 95320 3de01e 95309->95320 95313 3de00c 2 API calls 95312->95313 95314 3ddf01 GetNativeSystemInfo 95313->95314 95314->95297 95315->95286 95317 3ddea0 95316->95317 95318 3ddf92 LoadLibraryA 95316->95318 95317->95285 95317->95286 95318->95317 95319 3ddfa3 GetProcAddress 95318->95319 95319->95317 95321 3ddef1 95320->95321 95322 3de027 LoadLibraryA 95320->95322 95321->95295 95321->95296 95322->95321 95323 3de038 GetProcAddress 95322->95323 95323->95321 95324 4319cb 95329 3c2322 95324->95329 95326 4319d1 95362 3e0f0a 52 API calls __cinit 95326->95362 95328 4319db 95330 3c2344 95329->95330 95363 3c26df 95330->95363 95335 3cd7f7 48 API calls 95336 3c2384 95335->95336 95337 3cd7f7 48 API calls 95336->95337 95338 3c238e 95337->95338 95339 3cd7f7 48 API calls 95338->95339 95340 3c2398 95339->95340 95341 3cd7f7 48 API calls 95340->95341 95342 3c23de 95341->95342 95343 3cd7f7 48 API calls 95342->95343 95344 3c24c1 95343->95344 95371 3c263f 95344->95371 95348 3c24f1 95349 3cd7f7 48 API calls 95348->95349 95350 3c24fb 95349->95350 95400 3c2745 95350->95400 95352 3c2546 95353 3c2556 GetStdHandle 95352->95353 95354 3c25b1 95353->95354 95355 43501d 95353->95355 95356 3c25b7 CoInitialize 95354->95356 95355->95354 95357 435026 95355->95357 95356->95326 95407 4092d4 53 API calls 95357->95407 95359 43502d 95408 4099f9 CreateThread 95359->95408 95361 435039 CloseHandle 95361->95356 95362->95328 95409 3c2854 95363->95409 95366 3c6a63 48 API calls 95367 3c234a 95366->95367 95368 3c272e 95367->95368 95423 3c27ec 6 API calls 95368->95423 95370 3c237a 95370->95335 95372 3cd7f7 48 API calls 95371->95372 95373 3c264f 95372->95373 95374 3cd7f7 48 API calls 95373->95374 95375 3c2657 95374->95375 95424 3c26a7 95375->95424 95378 3c26a7 48 API calls 95379 3c2667 95378->95379 95380 3cd7f7 48 API calls 95379->95380 95381 3c2672 95380->95381 95382 3df4ea 48 API calls 95381->95382 95383 3c24cb 95382->95383 95384 3c22a4 95383->95384 95385 3c22b2 95384->95385 95386 3cd7f7 48 API calls 95385->95386 95387 3c22bd 95386->95387 95388 3cd7f7 48 API calls 95387->95388 95389 3c22c8 95388->95389 95390 3cd7f7 48 API calls 95389->95390 95391 3c22d3 95390->95391 95392 3cd7f7 48 API calls 95391->95392 95393 3c22de 95392->95393 95394 3c26a7 48 API calls 95393->95394 95395 3c22e9 95394->95395 95396 3df4ea 48 API calls 95395->95396 95397 3c22f0 95396->95397 95398 431fe7 95397->95398 95399 3c22f9 RegisterWindowMessageW 95397->95399 95399->95348 95401 3c2755 95400->95401 95402 435f4d 95400->95402 95404 3df4ea 48 API calls 95401->95404 95429 40c942 50 API calls 95402->95429 95406 3c275d 95404->95406 95405 435f58 95406->95352 95407->95359 95408->95361 95430 4099df 54 API calls 95408->95430 95416 3c2870 95409->95416 95412 3c2870 48 API calls 95413 3c2864 95412->95413 95414 3cd7f7 48 API calls 95413->95414 95415 3c2716 95414->95415 95415->95366 95417 3cd7f7 48 API calls 95416->95417 95418 3c287b 95417->95418 95419 3cd7f7 48 API calls 95418->95419 95420 3c2883 95419->95420 95421 3cd7f7 48 API calls 95420->95421 95422 3c285c 95421->95422 95422->95412 95423->95370 95425 3cd7f7 48 API calls 95424->95425 95426 3c26b0 95425->95426 95427 3cd7f7 48 API calls 95426->95427 95428 3c265f 95427->95428 95428->95378 95429->95405 95431 4319ba 95436 3dc75a 95431->95436 95435 4319c9 95437 3cd7f7 48 API calls 95436->95437 95438 3dc7c8 95437->95438 95444 3dd26c 95438->95444 95441 3dc865 95442 3dc881 95441->95442 95447 3dd1fa 48 API calls _memcpy_s 95441->95447 95443 3e0f0a 52 API calls __cinit 95442->95443 95443->95435 95448 3dd298 95444->95448 95447->95441 95449 3dd28b 95448->95449 95450 3dd2a5 95448->95450 95449->95441 95450->95449 95451 3dd2ac RegOpenKeyExW 95450->95451 95451->95449 95452 3dd2c6 RegQueryValueExW 95451->95452 95453 3dd2fc RegCloseKey 95452->95453 95454 3dd2e7 95452->95454 95453->95449 95454->95453 95455 438eb8 95459 40a635 95455->95459 95457 438ec3 95458 40a635 84 API calls 95457->95458 95458->95457 95460 40a66f 95459->95460 95464 40a642 95459->95464 95460->95457 95461 40a671 95471 3dec4e 81 API calls 95461->95471 95462 40a676 95465 3c936c 81 API calls 95462->95465 95464->95460 95464->95461 95464->95462 95468 40a669 95464->95468 95466 40a67d 95465->95466 95467 3c510d 48 API calls 95466->95467 95467->95460 95470 3d4525 61 API calls _memcpy_s 95468->95470 95470->95460 95471->95462 95472 3cf030 95475 3d3b70 95472->95475 95474 3cf03c 95476 3d3bc8 95475->95476 95530 3d42a5 95475->95530 95477 3d3bef 95476->95477 95479 436fd1 95476->95479 95482 436f7e 95476->95482 95488 436f9b 95476->95488 95478 3df4ea 48 API calls 95477->95478 95480 3d3c18 95478->95480 95555 41ceca 335 API calls Mailbox 95479->95555 95483 3df4ea 48 API calls 95480->95483 95482->95477 95484 436f87 95482->95484 95537 3d3c2c _memcpy_s __wsetenvp 95483->95537 95552 41d552 335 API calls Mailbox 95484->95552 95485 436fbe 95554 40cc5c 86 API calls 4 library calls 95485->95554 95488->95485 95553 41da0e 335 API calls 2 library calls 95488->95553 95490 3d42f2 95574 40cc5c 86 API calls 4 library calls 95490->95574 95492 4373b0 95492->95474 95493 437297 95563 40cc5c 86 API calls 4 library calls 95493->95563 95494 43737a 95573 40cc5c 86 API calls 4 library calls 95494->95573 95498 3ddce0 53 API calls 95498->95537 95499 3d40df 95564 40cc5c 86 API calls 4 library calls 95499->95564 95501 43707e 95556 40cc5c 86 API calls 4 library calls 95501->95556 95503 3cd6e9 55 API calls 95503->95537 95506 3d3f2b 95506->95474 95507 3cd645 53 API calls 95507->95537 95510 4372d2 95565 40cc5c 86 API calls 4 library calls 95510->95565 95512 437350 95571 40cc5c 86 API calls 4 library calls 95512->95571 95514 3cfe30 335 API calls 95514->95537 95515 437363 95572 40cc5c 86 API calls 4 library calls 95515->95572 95517 4372e9 95566 40cc5c 86 API calls 4 library calls 95517->95566 95520 3c6a63 48 API calls 95520->95537 95522 43714c 95560 41ccdc 48 API calls 95522->95560 95523 3df4ea 48 API calls 95523->95537 95524 3dc050 48 API calls 95524->95537 95526 43733f 95570 40cc5c 86 API calls 4 library calls 95526->95570 95528 3cd286 48 API calls 95528->95537 95567 40cc5c 86 API calls 4 library calls 95530->95567 95531 3c6eed 48 API calls 95531->95537 95532 4371a1 95562 3dc15c 48 API calls 95532->95562 95535 3dee75 48 API calls 95535->95537 95537->95490 95537->95493 95537->95494 95537->95498 95537->95499 95537->95501 95537->95503 95537->95506 95537->95507 95537->95510 95537->95512 95537->95514 95537->95515 95537->95517 95537->95520 95537->95522 95537->95523 95537->95524 95537->95526 95537->95528 95537->95530 95537->95531 95537->95535 95538 4371e1 95537->95538 95547 3cd9a0 53 API calls __cinit 95537->95547 95548 3cd83d 53 API calls 95537->95548 95549 3ccdb9 48 API calls 95537->95549 95550 3dc15c 48 API calls 95537->95550 95551 3dbecb 335 API calls 95537->95551 95557 3cdcae 50 API calls Mailbox 95537->95557 95558 41ccdc 48 API calls 95537->95558 95559 40a1eb 50 API calls 95537->95559 95538->95506 95569 40cc5c 86 API calls 4 library calls 95538->95569 95539 43715f 95539->95532 95561 41ccdc 48 API calls 95539->95561 95541 4371ce 95542 3dc050 48 API calls 95541->95542 95544 4371d6 95542->95544 95543 4371ab 95543->95530 95543->95541 95544->95538 95545 437313 95544->95545 95568 40cc5c 86 API calls 4 library calls 95545->95568 95547->95537 95548->95537 95549->95537 95550->95537 95551->95537 95552->95506 95553->95485 95554->95479 95555->95537 95556->95506 95557->95537 95558->95537 95559->95537 95560->95539 95561->95539 95562->95543 95563->95499 95564->95506 95565->95517 95566->95506 95567->95506 95568->95506 95569->95506 95570->95506 95571->95506 95572->95506 95573->95506 95574->95492 95575 3cef80 95576 3d3b70 335 API calls 95575->95576 95577 3cef8c 95576->95577 95578 3c3742 95579 3c374b 95578->95579 95580 3c37c8 95579->95580 95581 3c3769 95579->95581 95617 3c37c6 95579->95617 95585 3c37ce 95580->95585 95586 431e00 95580->95586 95582 3c382c PostQuitMessage 95581->95582 95583 3c3776 95581->95583 95619 3c37b9 95582->95619 95588 431e88 95583->95588 95589 3c3781 95583->95589 95584 3c37ab DefWindowProcW 95584->95619 95590 3c37f6 SetTimer RegisterWindowMessageW 95585->95590 95591 3c37d3 95585->95591 95633 3c2ff6 16 API calls 95586->95633 95638 404ddd 60 API calls _memset 95588->95638 95595 3c3789 95589->95595 95596 3c3836 95589->95596 95597 3c381f CreatePopupMenu 95590->95597 95590->95619 95592 431da3 95591->95592 95593 3c37da KillTimer 95591->95593 95605 431da8 95592->95605 95606 431ddc MoveWindow 95592->95606 95630 3c3847 Shell_NotifyIconW _memset 95593->95630 95594 431e27 95634 3de312 335 API calls Mailbox 95594->95634 95601 3c3794 95595->95601 95602 431e6d 95595->95602 95623 3deb83 95596->95623 95597->95619 95608 431e58 95601->95608 95614 3c379f 95601->95614 95602->95584 95637 3fa5f3 48 API calls 95602->95637 95603 431e9a 95603->95584 95603->95619 95609 431dcb SetFocus 95605->95609 95610 431dac 95605->95610 95606->95619 95607 3c37ed 95631 3c390f DeleteObject DestroyWindow Mailbox 95607->95631 95636 4055bd 70 API calls _memset 95608->95636 95609->95619 95610->95614 95615 431db5 95610->95615 95614->95584 95635 3c3847 Shell_NotifyIconW _memset 95614->95635 95632 3c2ff6 16 API calls 95615->95632 95616 431e68 95616->95619 95617->95584 95621 431e4c 95622 3c4ffc 67 API calls 95621->95622 95622->95617 95624 3dec1c 95623->95624 95625 3deb9a _memset 95623->95625 95624->95619 95626 3c51af 50 API calls 95625->95626 95628 3debc1 95626->95628 95627 3dec05 KillTimer SetTimer 95627->95624 95628->95627 95629 433c7a Shell_NotifyIconW 95628->95629 95629->95627 95630->95607 95631->95619 95632->95619 95633->95594 95634->95614 95635->95621 95636->95616 95637->95617 95638->95603 95639 4319dd 95644 3c4a30 95639->95644 95641 4319f1 95664 3e0f0a 52 API calls __cinit 95641->95664 95643 4319fb 95645 3c4a40 __ftell_nolock 95644->95645 95646 3cd7f7 48 API calls 95645->95646 95647 3c4af6 95646->95647 95648 3c5374 50 API calls 95647->95648 95649 3c4aff 95648->95649 95665 3c363c 95649->95665 95652 3c518c 48 API calls 95653 3c4b18 95652->95653 95654 3c64cf 48 API calls 95653->95654 95655 3c4b29 95654->95655 95656 3cd7f7 48 API calls 95655->95656 95657 3c4b32 95656->95657 95671 3c49fb 95657->95671 95659 3c4b43 Mailbox 95659->95641 95660 3c61a6 48 API calls 95663 3c4b3d _wcscat Mailbox __wsetenvp 95660->95663 95661 3cce19 48 API calls 95661->95663 95662 3c64cf 48 API calls 95662->95663 95663->95659 95663->95660 95663->95661 95663->95662 95664->95643 95666 3c3649 __ftell_nolock 95665->95666 95685 3c366c GetFullPathNameW 95666->95685 95668 3c365a 95669 3c6a63 48 API calls 95668->95669 95670 3c3669 95669->95670 95670->95652 95687 3cbcce 95671->95687 95674 3c4a2b 95674->95663 95675 4341cc RegQueryValueExW 95676 434246 RegCloseKey 95675->95676 95677 4341e5 95675->95677 95678 3df4ea 48 API calls 95677->95678 95679 4341fe 95678->95679 95680 3c47b7 48 API calls 95679->95680 95681 434208 RegQueryValueExW 95680->95681 95682 434224 95681->95682 95684 43423b 95681->95684 95683 3c6a63 48 API calls 95682->95683 95683->95684 95684->95676 95686 3c368a 95685->95686 95686->95668 95688 3cbce8 95687->95688 95689 3c4a0a RegOpenKeyExW 95687->95689 95690 3df4ea 48 API calls 95688->95690 95689->95674 95689->95675 95691 3cbcf2 95690->95691 95692 3dee75 48 API calls 95691->95692 95692->95689 95693 439bec 95728 3d0ae0 _memcpy_s Mailbox 95693->95728 95695 3df4ea 48 API calls 95695->95728 95698 3df4ea 48 API calls 95719 3cfec8 95698->95719 95700 3d0509 95788 40cc5c 86 API calls 4 library calls 95700->95788 95701 3d146e 95706 3c6eed 48 API calls 95701->95706 95703 3c6eed 48 API calls 95703->95719 95704 3d1473 95787 40cc5c 86 API calls 4 library calls 95704->95787 95724 3cffe1 Mailbox 95706->95724 95707 43a246 95711 3c6eed 48 API calls 95707->95711 95709 43a922 95711->95724 95713 3cd7f7 48 API calls 95713->95719 95714 3f97ed InterlockedDecrement 95714->95719 95715 43a873 95716 43a30e 95716->95724 95783 3f97ed InterlockedDecrement 95716->95783 95717 3cce19 48 API calls 95717->95728 95719->95698 95719->95700 95719->95701 95719->95703 95719->95704 95719->95707 95719->95713 95719->95714 95719->95716 95720 43a973 95719->95720 95721 3e0f0a 52 API calls __cinit 95719->95721 95719->95724 95725 3d15b5 95719->95725 95780 3d1820 335 API calls 2 library calls 95719->95780 95781 3d1d10 59 API calls Mailbox 95719->95781 95789 40cc5c 86 API calls 4 library calls 95720->95789 95721->95719 95723 43a982 95786 40cc5c 86 API calls 4 library calls 95725->95786 95726 41e822 335 API calls 95726->95728 95727 3cfe30 335 API calls 95727->95728 95728->95695 95728->95717 95728->95719 95728->95724 95728->95726 95728->95727 95729 43a706 95728->95729 95731 3d1526 Mailbox 95728->95731 95732 3f97ed InterlockedDecrement 95728->95732 95733 416ff0 335 API calls 95728->95733 95736 420d1d 95728->95736 95739 420d09 95728->95739 95742 41f0ac 95728->95742 95774 40a6ef 95728->95774 95782 41ef61 82 API calls 2 library calls 95728->95782 95784 40cc5c 86 API calls 4 library calls 95729->95784 95785 40cc5c 86 API calls 4 library calls 95731->95785 95732->95728 95733->95728 95790 41f8ae 95736->95790 95738 420d2d 95738->95728 95740 41f8ae 129 API calls 95739->95740 95741 420d19 95740->95741 95741->95728 95743 3cd7f7 48 API calls 95742->95743 95744 41f0c0 95743->95744 95745 3cd7f7 48 API calls 95744->95745 95746 41f0c8 95745->95746 95747 3cd7f7 48 API calls 95746->95747 95748 41f0d0 95747->95748 95749 3c936c 81 API calls 95748->95749 95773 41f0de 95749->95773 95750 3c6a63 48 API calls 95750->95773 95751 41f2cc 95755 41f2f9 Mailbox 95751->95755 95892 3c6b68 48 API calls 95751->95892 95753 41f2b3 95754 3c518c 48 API calls 95753->95754 95759 41f2c0 95754->95759 95755->95728 95756 3cc799 48 API calls 95756->95773 95757 41f2ce 95760 3c518c 48 API calls 95757->95760 95758 3c6eed 48 API calls 95758->95773 95762 3c510d 48 API calls 95759->95762 95763 41f2dd 95760->95763 95761 3cbdfa 48 API calls 95764 41f175 CharUpperBuffW 95761->95764 95762->95751 95765 3c510d 48 API calls 95763->95765 95767 3cd645 53 API calls 95764->95767 95765->95751 95766 3cbdfa 48 API calls 95768 41f23a CharUpperBuffW 95766->95768 95767->95773 95891 3dd922 55 API calls 2 library calls 95768->95891 95770 3c936c 81 API calls 95770->95773 95771 3c518c 48 API calls 95771->95773 95772 3c510d 48 API calls 95772->95773 95773->95750 95773->95751 95773->95753 95773->95755 95773->95756 95773->95757 95773->95758 95773->95761 95773->95766 95773->95770 95773->95771 95773->95772 95775 40a6fb 95774->95775 95776 3df4ea 48 API calls 95775->95776 95777 40a709 95776->95777 95778 3cd7f7 48 API calls 95777->95778 95779 40a717 95777->95779 95778->95779 95779->95728 95780->95719 95781->95719 95782->95728 95783->95724 95784->95731 95785->95724 95786->95724 95787->95715 95788->95709 95789->95723 95791 3c936c 81 API calls 95790->95791 95792 41f8ea 95791->95792 95793 41f92c Mailbox 95792->95793 95826 420567 95792->95826 95793->95738 95795 41fb8b 95796 41fcfa 95795->95796 95802 41fb95 95795->95802 95874 420688 89 API calls Mailbox 95796->95874 95799 41fd07 95801 41fd13 95799->95801 95799->95802 95800 3c936c 81 API calls 95819 41f984 Mailbox 95800->95819 95801->95793 95839 41f70a 95802->95839 95807 41fbc9 95853 3ded18 95807->95853 95810 41fbe3 95872 40cc5c 86 API calls 4 library calls 95810->95872 95811 41fbfd 95813 3dc050 48 API calls 95811->95813 95815 41fc14 95813->95815 95814 41fbee GetCurrentProcess TerminateProcess 95814->95811 95817 3d1b90 48 API calls 95815->95817 95825 41fc3e 95815->95825 95816 41fd65 95816->95793 95822 41fd7e FreeLibrary 95816->95822 95818 41fc2d 95817->95818 95821 42040f 105 API calls 95818->95821 95819->95793 95819->95795 95819->95800 95870 4229e8 48 API calls _memcpy_s 95819->95870 95871 41fda5 60 API calls 2 library calls 95819->95871 95820 3d1b90 48 API calls 95820->95825 95821->95825 95822->95793 95825->95816 95825->95820 95857 42040f 95825->95857 95873 3cdcae 50 API calls Mailbox 95825->95873 95827 3cbdfa 48 API calls 95826->95827 95828 420582 CharLowerBuffW 95827->95828 95875 401f11 95828->95875 95832 3cd7f7 48 API calls 95833 4205bb 95832->95833 95882 3c69e9 48 API calls _memcpy_s 95833->95882 95835 42061a Mailbox 95835->95819 95836 4205d2 95837 3cb18b 48 API calls 95836->95837 95838 4205de Mailbox 95837->95838 95838->95835 95883 41fda5 60 API calls 2 library calls 95838->95883 95840 41f725 95839->95840 95844 41f77a 95839->95844 95841 3df4ea 48 API calls 95840->95841 95842 41f747 95841->95842 95843 3df4ea 48 API calls 95842->95843 95842->95844 95843->95842 95845 420828 95844->95845 95846 420a53 Mailbox 95845->95846 95852 42084b _strcat _wcscpy __wsetenvp 95845->95852 95846->95807 95847 3ccf93 58 API calls 95847->95852 95848 3cd286 48 API calls 95848->95852 95849 3c936c 81 API calls 95849->95852 95850 3e395c 47 API calls __crtLCMapStringA_stat 95850->95852 95852->95846 95852->95847 95852->95848 95852->95849 95852->95850 95886 408035 50 API calls __wsetenvp 95852->95886 95854 3ded2d 95853->95854 95855 3dedc5 VirtualProtect 95854->95855 95856 3ded93 95854->95856 95855->95856 95856->95810 95856->95811 95858 420427 95857->95858 95862 420443 95857->95862 95859 4204f8 95858->95859 95860 42042e 95858->95860 95861 42044f 95858->95861 95858->95862 95890 409dc5 103 API calls 95859->95890 95887 407c56 50 API calls _strlen 95860->95887 95889 3ccdb9 48 API calls 95861->95889 95865 3e1c9d _free 47 API calls 95862->95865 95868 42051e 95862->95868 95865->95868 95867 420438 95888 3ccdb9 48 API calls 95867->95888 95868->95825 95870->95819 95871->95819 95872->95814 95873->95825 95874->95799 95876 401f3b __wsetenvp 95875->95876 95877 401f79 95876->95877 95879 401f6f 95876->95879 95880 401ffa 95876->95880 95877->95832 95877->95838 95879->95877 95884 3dd37a 60 API calls 95879->95884 95880->95877 95885 3dd37a 60 API calls 95880->95885 95882->95836 95883->95835 95884->95879 95885->95880 95886->95852 95887->95867 95888->95862 95889->95862 95890->95862 95891->95773 95892->95755

                                                                                                    Executed Functions

                                                                                                    Function 003EB043 Relevance: 21.5, APIs: 14, Instructions: 537COMMONLIBRARYCODE
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    • Executed
                                                                                                    • Not Executed
                                                                                                    control_flow_graph 857 3eb043-3eb080 call 3ef8a0 860 3eb089-3eb08b 857->860 861 3eb082-3eb084 857->861 863 3eb0ac-3eb0d9 860->863 864 3eb08d-3eb0a7 call 3e7bda call 3e7c0e call 3e6e10 860->864 862 3eb860-3eb86c call 3ea70c 861->862 867 3eb0db-3eb0de 863->867 868 3eb0e0-3eb0e7 863->868 864->862 867->868 871 3eb10b-3eb110 867->871 872 3eb0e9-3eb100 call 3e7bda call 3e7c0e call 3e6e10 868->872 873 3eb105 868->873 875 3eb11f-3eb12d call 3f3bf2 871->875 876 3eb112-3eb11c call 3ef82f 871->876 903 3eb851-3eb854 872->903 873->871 888 3eb44b-3eb45d 875->888 889 3eb133-3eb145 875->889 876->875 890 3eb7b8-3eb7d5 WriteFile 888->890 891 3eb463-3eb473 888->891 889->888 893 3eb14b-3eb183 call 3e7a0d GetConsoleMode 889->893 897 3eb7d7-3eb7df 890->897 898 3eb7e1-3eb7e7 GetLastError 890->898 894 3eb55a-3eb55f 891->894 895 3eb479-3eb484 891->895 893->888 907 3eb189-3eb18f 893->907 905 3eb565-3eb56e 894->905 906 3eb663-3eb66e 894->906 901 3eb48a-3eb49a 895->901 902 3eb81b-3eb833 895->902 904 3eb7e9 897->904 898->904 908 3eb4a0-3eb4a3 901->908 909 3eb83e-3eb84e call 3e7c0e call 3e7bda 902->909 910 3eb835-3eb838 902->910 914 3eb85e-3eb85f 903->914 912 3eb7ef-3eb7f1 904->912 905->902 913 3eb574 905->913 906->902 911 3eb674 906->911 915 3eb199-3eb1bc GetConsoleCP 907->915 916 3eb191-3eb193 907->916 917 3eb4e9-3eb520 WriteFile 908->917 918 3eb4a5-3eb4be 908->918 909->903 910->909 919 3eb83a-3eb83c 910->919 920 3eb67e-3eb693 911->920 922 3eb856-3eb85c 912->922 923 3eb7f3-3eb7f5 912->923 924 3eb57e-3eb595 913->924 914->862 925 3eb1c2-3eb1ca 915->925 926 3eb440-3eb446 915->926 916->888 916->915 917->898 929 3eb526-3eb538 917->929 927 3eb4cb-3eb4e7 918->927 928 3eb4c0-3eb4ca 918->928 919->914 930 3eb699-3eb69b 920->930 922->914 923->902 932 3eb7f7-3eb7fc 923->932 933 3eb59b-3eb59e 924->933 936 3eb1d4-3eb1d6 925->936 926->923 927->908 927->917 928->927 929->912 937 3eb53e-3eb54f 929->937 938 3eb69d-3eb6b3 930->938 939 3eb6d8-3eb719 WideCharToMultiByte 930->939 941 3eb7fe-3eb810 call 3e7c0e call 3e7bda 932->941 942 3eb812-3eb819 call 3e7bed 932->942 934 3eb5de-3eb627 WriteFile 933->934 935 3eb5a0-3eb5b6 933->935 934->898 945 3eb62d-3eb645 934->945 943 3eb5cd-3eb5dc 935->943 944 3eb5b8-3eb5ca 935->944 947 3eb1dc-3eb1fe 936->947 948 3eb36b-3eb36e 936->948 937->901 949 3eb555 937->949 950 3eb6c7-3eb6d6 938->950 951 3eb6b5-3eb6c4 938->951 939->898 953 3eb71f-3eb721 939->953 941->903 942->903 943->933 943->934 944->943 945->912 957 3eb64b-3eb658 945->957 959 3eb217-3eb223 call 3e1688 947->959 960 3eb200-3eb215 947->960 961 3eb375-3eb3a2 948->961 962 3eb370-3eb373 948->962 949->912 950->930 950->939 951->950 955 3eb727-3eb75a WriteFile 953->955 963 3eb75c-3eb776 955->963 964 3eb77a-3eb78e GetLastError 955->964 957->924 966 3eb65e 957->966 981 3eb269-3eb26b 959->981 982 3eb225-3eb239 959->982 967 3eb271-3eb283 call 3f40f7 960->967 969 3eb3a8-3eb3ab 961->969 962->961 962->969 963->955 972 3eb778 963->972 975 3eb794-3eb796 964->975 966->912 984 3eb289 967->984 985 3eb435-3eb43b 967->985 970 3eb3ad-3eb3b0 969->970 971 3eb3b2-3eb3c5 call 3f5884 969->971 970->971 977 3eb407-3eb40a 970->977 971->898 990 3eb3cb-3eb3d5 971->990 972->975 975->904 980 3eb798-3eb7b0 975->980 977->936 987 3eb410 977->987 980->920 986 3eb7b6 980->986 981->967 988 3eb23f-3eb254 call 3f40f7 982->988 989 3eb412-3eb42d 982->989 991 3eb28f-3eb2c4 WideCharToMultiByte 984->991 985->904 986->912 987->985 988->985 999 3eb25a-3eb267 988->999 989->985 993 3eb3fb-3eb401 990->993 994 3eb3d7-3eb3ee call 3f5884 990->994 991->985 995 3eb2ca-3eb2f0 WriteFile 991->995 993->977 994->898 1002 3eb3f4-3eb3f5 994->1002 995->898 998 3eb2f6-3eb30e 995->998 998->985 1001 3eb314-3eb31b 998->1001 999->991 1001->993 1003 3eb321-3eb34c WriteFile 1001->1003 1002->993 1003->898 1004 3eb352-3eb359 1003->1004 1004->985 1005 3eb35f-3eb366 1004->1005 1005->993
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: 9ba999945129867780bb8c4de793097b14f7b0c5a866890f7972efc3505a289d
                                                                                                    • Instruction ID: 4328faeeb74299d781bbd8edcbe13fca2ad106f46dd1054bacdf0324a5d1cdc7
                                                                                                    • Opcode Fuzzy Hash: 9ba999945129867780bb8c4de793097b14f7b0c5a866890f7972efc3505a289d
                                                                                                    • Instruction Fuzzy Hash: 25326075B122A98FCB26CF16DC416EAB7B5FF46310F1542D9E40AA7A81D7309E80CF52
                                                                                                    Function 003C3D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151windowCOMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    APIs
                                                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,003C3AA3,?), ref: 003C3D45
                                                                                                    • IsDebuggerPresent.KERNEL32(?,?,?,?,003C3AA3,?), ref: 003C3D57
                                                                                                    • GetFullPathNameW.KERNEL32(00007FFF,?,?,00481148,00481130,?,?,?,?,003C3AA3,?), ref: 003C3DC8
                                                                                                      • Part of subcall function 003C6430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,003C3DEE,00481148,?,?,?,?,?,003C3AA3,?), ref: 003C6471
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,003C3AA3,?), ref: 003C3E48
                                                                                                    • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,004728F4,00000010), ref: 00431CCE
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?,00481148,?,?,?,?,?,003C3AA3,?), ref: 00431D06
                                                                                                    • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,0045DAB4,00481148,?,?,?,?,?,003C3AA3,?), ref: 00431D89
                                                                                                    • ShellExecuteW.SHELL32(00000000,?,?,?,?,003C3AA3), ref: 00431D90
                                                                                                      • Part of subcall function 003C3E6E: GetSysColorBrush.USER32(0000000F), ref: 003C3E79
                                                                                                      • Part of subcall function 003C3E6E: LoadCursorW.USER32(00000000,00007F00), ref: 003C3E88
                                                                                                      • Part of subcall function 003C3E6E: LoadIconW.USER32(00000063), ref: 003C3E9E
                                                                                                      • Part of subcall function 003C3E6E: LoadIconW.USER32(000000A4), ref: 003C3EB0
                                                                                                      • Part of subcall function 003C3E6E: LoadIconW.USER32(000000A2), ref: 003C3EC2
                                                                                                      • Part of subcall function 003C3E6E: RegisterClassExW.USER32(?), ref: 003C3F30
                                                                                                      • Part of subcall function 003C36B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 003C36E6
                                                                                                      • Part of subcall function 003C36B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 003C3707
                                                                                                      • Part of subcall function 003C36B8: ShowWindow.USER32(00000000,?,?,?,?,003C3AA3,?), ref: 003C371B
                                                                                                      • Part of subcall function 003C36B8: ShowWindow.USER32(00000000,?,?,?,?,003C3AA3,?), ref: 003C3724
                                                                                                      • Part of subcall function 003C4FFC: _memset.LIBCMT ref: 003C5022
                                                                                                      • Part of subcall function 003C4FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 003C50CB
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
                                                                                                    • String ID: ()G$This is a third-party compiled AutoIt script.$runas
                                                                                                    • API String ID: 438480954-1973934273
                                                                                                    • Opcode ID: 79f97f3afc60141c7bc852570feff6f79ea566e1463545f2ad356d06447c1933
                                                                                                    • Instruction ID: 0d961193d0c12b252be59de51eee24ff3b5d528f5783f06b574b5c4f5f218ba7
                                                                                                    • Opcode Fuzzy Hash: 79f97f3afc60141c7bc852570feff6f79ea566e1463545f2ad356d06447c1933
                                                                                                    • Instruction Fuzzy Hash: 8151F631E04244AACB13BBF4DC49FEE7B799B09700F00843EF541EA1A2CA785E468725
                                                                                                    Function 003DDDC0 Relevance: 10.7, APIs: 7, Instructions: 175COMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    • Executed
                                                                                                    • Not Executed
                                                                                                    control_flow_graph 1289 3dddc0-3dde4f call 3cd7f7 GetVersionExW call 3c6a63 call 3ddfb4 call 3c6571 1298 3dde55-3dde56 1289->1298 1299 4324c8-4324cb 1289->1299 1300 3dde58-3dde63 1298->1300 1301 3dde92-3ddea2 call 3ddf77 1298->1301 1302 4324e4-4324e8 1299->1302 1303 4324cd 1299->1303 1306 3dde69-3dde6b 1300->1306 1307 43244e-432454 1300->1307 1320 3ddea4-3ddec1 GetCurrentProcess call 3ddf5f 1301->1320 1321 3ddec7-3ddee1 1301->1321 1304 4324d3-4324dc 1302->1304 1305 4324ea-4324f3 1302->1305 1309 4324d0 1303->1309 1304->1302 1305->1309 1312 4324f5-4324f8 1305->1312 1313 432469-432475 1306->1313 1314 3dde71-3dde74 1306->1314 1310 432456-432459 1307->1310 1311 43245e-432464 1307->1311 1309->1304 1310->1301 1311->1301 1312->1304 1316 432477-43247a 1313->1316 1317 43247f-432485 1313->1317 1318 432495-432498 1314->1318 1319 3dde7a-3dde89 1314->1319 1316->1301 1317->1301 1318->1301 1324 43249e-4324b3 1318->1324 1325 3dde8f 1319->1325 1326 43248a-432490 1319->1326 1320->1321 1340 3ddec3 1320->1340 1322 3ddf31-3ddf3b GetSystemInfo 1321->1322 1323 3ddee3-3ddef7 call 3de00c 1321->1323 1328 3ddf0e-3ddf1a 1322->1328 1337 3ddf29-3ddf2f GetSystemInfo 1323->1337 1338 3ddef9-3ddf01 call 3ddff4 GetNativeSystemInfo 1323->1338 1330 4324b5-4324b8 1324->1330 1331 4324bd-4324c3 1324->1331 1325->1301 1326->1301 1334 3ddf1c-3ddf1f FreeLibrary 1328->1334 1335 3ddf21-3ddf26 1328->1335 1330->1301 1331->1301 1334->1335 1339 3ddf03-3ddf07 1337->1339 1338->1339 1339->1328 1343 3ddf09-3ddf0c FreeLibrary 1339->1343 1340->1321 1343->1328
                                                                                                    APIs
                                                                                                    • GetVersionExW.KERNEL32(?), ref: 003DDDEC
                                                                                                    • GetCurrentProcess.KERNEL32(00000000,0045DC38,?,?), ref: 003DDEAC
                                                                                                    • GetNativeSystemInfo.KERNELBASE(?,0045DC38,?,?), ref: 003DDF01
                                                                                                    • FreeLibrary.KERNEL32(00000000,?,?), ref: 003DDF0C
                                                                                                    • FreeLibrary.KERNEL32(00000000,?,?), ref: 003DDF1F
                                                                                                    • GetSystemInfo.KERNEL32(?,0045DC38,?,?), ref: 003DDF29
                                                                                                    • GetSystemInfo.KERNEL32(?,0045DC38,?,?), ref: 003DDF35
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
                                                                                                    • String ID:
                                                                                                    • API String ID: 3851250370-0
                                                                                                    • Opcode ID: c5d26b84c2981ab65ab3ef2e7af0772038e5821d15d06a2c5853517a8a38d04b
                                                                                                    • Instruction ID: f9bb6fdc4d85372c17c116cd7d0394a8ae3375b88596e662c4d036e1a8795761
                                                                                                    • Opcode Fuzzy Hash: c5d26b84c2981ab65ab3ef2e7af0772038e5821d15d06a2c5853517a8a38d04b
                                                                                                    • Instruction Fuzzy Hash: 646193B280A384DBCF16CF68A8C15E97FB86F39300F1945DAD8859F347C664C909CB69
                                                                                                    Function 003C406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    • Executed
                                                                                                    • Not Executed
                                                                                                    control_flow_graph 1361 3c406b-3c4083 CreateStreamOnHGlobal 1362 3c4085-3c409c FindResourceExW 1361->1362 1363 3c40a3-3c40a6 1361->1363 1364 434f16-434f25 LoadResource 1362->1364 1365 3c40a2 1362->1365 1364->1365 1366 434f2b-434f39 SizeofResource 1364->1366 1365->1363 1366->1365 1367 434f3f-434f4a LockResource 1366->1367 1367->1365 1368 434f50-434f6e 1367->1368 1368->1365
                                                                                                    APIs
                                                                                                    • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,003C449E,?,?,00000000,00000001), ref: 003C407B
                                                                                                    • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,003C449E,?,?,00000000,00000001), ref: 003C4092
                                                                                                    • LoadResource.KERNEL32(?,00000000,?,?,003C449E,?,?,00000000,00000001,?,?,?,?,?,?,003C41FB), ref: 00434F1A
                                                                                                    • SizeofResource.KERNEL32(?,00000000,?,?,003C449E,?,?,00000000,00000001,?,?,?,?,?,?,003C41FB), ref: 00434F2F
                                                                                                    • LockResource.KERNEL32(003C449E,?,?,003C449E,?,?,00000000,00000001,?,?,?,?,?,?,003C41FB,00000000), ref: 00434F42
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                                                    • String ID: SCRIPT
                                                                                                    • API String ID: 3051347437-3967369404
                                                                                                    • Opcode ID: 67bcacbb9c3429cf9c822f0531b5bcc9cff3914cf31c3663c59e0ee8c1da793c
                                                                                                    • Instruction ID: 8a4194ca0dd4782cc17fee0cce907a4eaeafc782d85532034977cd170d3f6cb0
                                                                                                    • Opcode Fuzzy Hash: 67bcacbb9c3429cf9c822f0531b5bcc9cff3914cf31c3663c59e0ee8c1da793c
                                                                                                    • Instruction Fuzzy Hash: D6117C74640711BFE7228B25EC48F27BBB9EBC6B51F20456CF612C62A0DBB1DC048B20
                                                                                                    Function 003D3B70 Relevance: 5.9, Strings: 4, Instructions: 903COMMON
                                                                                                    Download Yara Rule
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Exception@8Throwstd::exception::exception
                                                                                                    • String ID: @$ H$ H$ H
                                                                                                    • API String ID: 3728558374-232645478
                                                                                                    • Opcode ID: 946bce0d71a0be00dcb2edcc1cb590e551e1b279224ef4f52aef1d88e4db6c51
                                                                                                    • Instruction ID: 776eb633a18320f570115d4ae0804880fcd3821500912f8a188b6624bcab31eb
                                                                                                    • Opcode Fuzzy Hash: 946bce0d71a0be00dcb2edcc1cb590e551e1b279224ef4f52aef1d88e4db6c51
                                                                                                    • Instruction Fuzzy Hash: 4A72E172D04209DFCF22DF94D481AAEB7B9EF48300F15806BE945AB391D734AE45CB96
                                                                                                    Function 00406CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetFileAttributesW.KERNELBASE(?,00432F49), ref: 00406CB9
                                                                                                    • FindFirstFileW.KERNELBASE(?,?), ref: 00406CCA
                                                                                                    • FindClose.KERNEL32(00000000), ref: 00406CDA
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: FileFind$AttributesCloseFirst
                                                                                                    • String ID:
                                                                                                    • API String ID: 48322524-0
                                                                                                    • Opcode ID: 161d8d3bdc4918ac8f597005b5e7bfea061a414210d53fa091638b7d85b03d97
                                                                                                    • Instruction ID: 75c7e7bd57c57fade85e9dcff88c7b9fd867dbbbda36257023f0fa88dba61724
                                                                                                    • Opcode Fuzzy Hash: 161d8d3bdc4918ac8f597005b5e7bfea061a414210d53fa091638b7d85b03d97
                                                                                                    • Instruction Fuzzy Hash: B6E0D835C1441057D2146738EC0D4EA37ACDA06339F10072AF972D12D0EB74D91045DE
                                                                                                    Function 003D3200 Relevance: 2.2, Strings: 1, Instructions: 986COMMON
                                                                                                    Download Yara Rule
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: BuffCharUpper
                                                                                                    • String ID: H
                                                                                                    • API String ID: 3964851224-162691484
                                                                                                    • Opcode ID: 81c1aaaab59d196ecc522ab3fe83f7bd041048f921eb0e3c7061b5c8af04948d
                                                                                                    • Instruction ID: 1d69244cce63ecd1d19bfc191741a5adeae0ce4a02b7a4f8f51b1d1adbcfbf5b
                                                                                                    • Opcode Fuzzy Hash: 81c1aaaab59d196ecc522ab3fe83f7bd041048f921eb0e3c7061b5c8af04948d
                                                                                                    • Instruction Fuzzy Hash: 019279716083419FD726DF18D480B6AB7E5BF88304F14886EF88A8B3A2D775ED45CB52
                                                                                                    Function 003CE8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003CE959
                                                                                                    • timeGetTime.WINMM ref: 003CEBFA
                                                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003CED2E
                                                                                                    • TranslateMessage.USER32(?), ref: 003CED3F
                                                                                                    • DispatchMessageW.USER32(?), ref: 003CED4A
                                                                                                    • LockWindowUpdate.USER32(00000000), ref: 003CED79
                                                                                                    • DestroyWindow.USER32 ref: 003CED85
                                                                                                    • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 003CED9F
                                                                                                    • Sleep.KERNEL32(0000000A), ref: 00435270
                                                                                                    • TranslateMessage.USER32(?), ref: 004359F7
                                                                                                    • DispatchMessageW.USER32(?), ref: 00435A05
                                                                                                    • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00435A19
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
                                                                                                    • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
                                                                                                    • API String ID: 2641332412-570651680
                                                                                                    • Opcode ID: 37651c78b6ee102dd0ae46b0e2ea34115ac2b566cd20cbac18884d327b0701d5
                                                                                                    • Instruction ID: 669aedcb833508ddcb033b53ff2fd98209a3f758de60291babf1bd0155f1c7ad
                                                                                                    • Opcode Fuzzy Hash: 37651c78b6ee102dd0ae46b0e2ea34115ac2b566cd20cbac18884d327b0701d5
                                                                                                    • Instruction Fuzzy Hash: 8C62BF70508340DFDB26DF24C885FAA77E4BF45304F18497EE9868B292DB749C48CB56
                                                                                                    Function 003F5C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • ___createFile.LIBCMT ref: 003F5EC3
                                                                                                    • ___createFile.LIBCMT ref: 003F5F04
                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 003F5F2D
                                                                                                    • __dosmaperr.LIBCMT ref: 003F5F34
                                                                                                    • GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 003F5F47
                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 003F5F6A
                                                                                                    • __dosmaperr.LIBCMT ref: 003F5F73
                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 003F5F7C
                                                                                                    • __set_osfhnd.LIBCMT ref: 003F5FAC
                                                                                                    • __lseeki64_nolock.LIBCMT ref: 003F6016
                                                                                                    • __close_nolock.LIBCMT ref: 003F603C
                                                                                                    • __chsize_nolock.LIBCMT ref: 003F606C
                                                                                                    • __lseeki64_nolock.LIBCMT ref: 003F607E
                                                                                                    • __lseeki64_nolock.LIBCMT ref: 003F6176
                                                                                                    • __lseeki64_nolock.LIBCMT ref: 003F618B
                                                                                                    • __close_nolock.LIBCMT ref: 003F61EB
                                                                                                      • Part of subcall function 003EEA9C: CloseHandle.KERNELBASE(00000000,0046EEF4,00000000,?,003F6041,0046EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 003EEAEC
                                                                                                      • Part of subcall function 003EEA9C: GetLastError.KERNEL32(?,003F6041,0046EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 003EEAF6
                                                                                                      • Part of subcall function 003EEA9C: __free_osfhnd.LIBCMT ref: 003EEB03
                                                                                                      • Part of subcall function 003EEA9C: __dosmaperr.LIBCMT ref: 003EEB25
                                                                                                      • Part of subcall function 003E7C0E: __getptd_noexit.LIBCMT ref: 003E7C0E
                                                                                                    • __lseeki64_nolock.LIBCMT ref: 003F620D
                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 003F6342
                                                                                                    • ___createFile.LIBCMT ref: 003F6361
                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 003F636E
                                                                                                    • __dosmaperr.LIBCMT ref: 003F6375
                                                                                                    • __free_osfhnd.LIBCMT ref: 003F6395
                                                                                                    • __invoke_watson.LIBCMT ref: 003F63C3
                                                                                                    • __wsopen_helper.LIBCMT ref: 003F63DD
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
                                                                                                    • String ID: @
                                                                                                    • API String ID: 3896587723-2766056989
                                                                                                    • Opcode ID: 0e4cd83a0ed16c1523ee5dc73fbaa5bd4b041d1d8f19fb7023407e3eb33bd15c
                                                                                                    • Instruction ID: 4d84c3c30e968443dd11addbbc65dc4c33744edf4f8b1604f2b4430ef06d08be
                                                                                                    • Opcode Fuzzy Hash: 0e4cd83a0ed16c1523ee5dc73fbaa5bd4b041d1d8f19fb7023407e3eb33bd15c
                                                                                                    • Instruction Fuzzy Hash: EC22367190460EAFEB2B9F68CC46BBD7B65EB11314F254229FB219B2E1C7358D40C791
                                                                                                    Function 0040FA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238COMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    APIs
                                                                                                    • _wcscpy.LIBCMT ref: 0040FA96
                                                                                                    • _wcschr.LIBCMT ref: 0040FAA4
                                                                                                    • _wcscpy.LIBCMT ref: 0040FABB
                                                                                                    • _wcscat.LIBCMT ref: 0040FACA
                                                                                                    • _wcscat.LIBCMT ref: 0040FAE8
                                                                                                    • _wcscpy.LIBCMT ref: 0040FB09
                                                                                                    • __wsplitpath.LIBCMT ref: 0040FBE6
                                                                                                    • _wcscpy.LIBCMT ref: 0040FC0B
                                                                                                    • _wcscpy.LIBCMT ref: 0040FC1D
                                                                                                    • _wcscpy.LIBCMT ref: 0040FC32
                                                                                                    • _wcscat.LIBCMT ref: 0040FC47
                                                                                                    • _wcscat.LIBCMT ref: 0040FC59
                                                                                                    • _wcscat.LIBCMT ref: 0040FC6E
                                                                                                      • Part of subcall function 0040BFA4: _wcscmp.LIBCMT ref: 0040C03E
                                                                                                      • Part of subcall function 0040BFA4: __wsplitpath.LIBCMT ref: 0040C083
                                                                                                      • Part of subcall function 0040BFA4: _wcscpy.LIBCMT ref: 0040C096
                                                                                                      • Part of subcall function 0040BFA4: _wcscat.LIBCMT ref: 0040C0A9
                                                                                                      • Part of subcall function 0040BFA4: __wsplitpath.LIBCMT ref: 0040C0CE
                                                                                                      • Part of subcall function 0040BFA4: _wcscat.LIBCMT ref: 0040C0E4
                                                                                                      • Part of subcall function 0040BFA4: _wcscat.LIBCMT ref: 0040C0F7
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
                                                                                                    • String ID: >>>AUTOIT SCRIPT<<<$t2G
                                                                                                    • API String ID: 2955681530-1691386586
                                                                                                    • Opcode ID: 3ed9b6ca54f42a177d181249411c1a0242ae23741bc7dd6ab03f48fad19d27ac
                                                                                                    • Instruction ID: 4cdef6f06a23aa165c761efbbdb2d67650814a9311b7decdbae3718b6016eb9e
                                                                                                    • Opcode Fuzzy Hash: 3ed9b6ca54f42a177d181249411c1a0242ae23741bc7dd6ab03f48fad19d27ac
                                                                                                    • Instruction Fuzzy Hash: 0291B272504245AFDB21EB50C851F9BB3E8BF84300F04496EF9499B291DB74FA48CB96
                                                                                                    Function 003EEE0E Relevance: 26.2, APIs: 17, Instructions: 664COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __getptd_noexit
                                                                                                    • String ID:
                                                                                                    • API String ID: 3074181302-0
                                                                                                    • Opcode ID: 8e55659d691cd93964bfd74e6b261294fb059b401da3d43b21a1c83ce7444b4a
                                                                                                    • Instruction ID: f3365798b131938b9d3da465eb886fe1005fb995960d538b3b81461d2ead9aca
                                                                                                    • Opcode Fuzzy Hash: 8e55659d691cd93964bfd74e6b261294fb059b401da3d43b21a1c83ce7444b4a
                                                                                                    • Instruction Fuzzy Hash: 62323874A042E5DFDB23CF6AC840BAD7BB1AF56310F25466AE8559F2D2C7B09C41CB60
                                                                                                    Function 003C3F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    APIs
                                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 003C3F86
                                                                                                    • RegisterClassExW.USER32(00000030), ref: 003C3FB0
                                                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003C3FC1
                                                                                                    • InitCommonControlsEx.COMCTL32(?), ref: 003C3FDE
                                                                                                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003C3FEE
                                                                                                    • LoadIconW.USER32(000000A9), ref: 003C4004
                                                                                                    • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003C4013
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                    • API String ID: 2914291525-1005189915
                                                                                                    • Opcode ID: 36ff9a609ff555a736f3f306fadb9b24001312a5ac05b12c6b5adfa786e89aa6
                                                                                                    • Instruction ID: cc1446dcd0f6225e9f9d0d4b59778f2e016e750b89d1a8628b3e7312daefe64e
                                                                                                    • Opcode Fuzzy Hash: 36ff9a609ff555a736f3f306fadb9b24001312a5ac05b12c6b5adfa786e89aa6
                                                                                                    • Instruction Fuzzy Hash: DB21F7B9D00318AFDB00DFA4EC89BCDBBB8FB09700F00462AF511A62A0D7B505458F98
                                                                                                    Function 0040BFA4 Relevance: 18.3, APIs: 12, Instructions: 316fileCOMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    • Executed
                                                                                                    • Not Executed
                                                                                                    control_flow_graph 1074 40bfa4-40c054 call 3ef8a0 call 3df4ea call 3c47b7 call 40bdb4 call 3c4517 call 3e15e3 1087 40c107-40c10e call 40c56d 1074->1087 1088 40c05a-40c061 call 40c56d 1074->1088 1093 40c110-40c112 1087->1093 1094 40c117 1087->1094 1088->1093 1095 40c067-40c105 call 3e1dfc call 3e0d23 call 3e0cf4 call 3e1dfc call 3e0cf4 * 2 1088->1095 1096 40c367-40c368 1093->1096 1098 40c11a-40c1d6 call 3c44ed * 8 call 40c71a call 3e3499 1094->1098 1095->1098 1099 40c385-40c393 call 3c47e2 1096->1099 1133 40c1d8-40c1da 1098->1133 1134 40c1df-40c1fa call 40bdf8 1098->1134 1133->1096 1137 40c200-40c208 1134->1137 1138 40c28c-40c298 call 3e35e4 1134->1138 1139 40c210 1137->1139 1140 40c20a-40c20e 1137->1140 1145 40c29a-40c2a9 DeleteFileW 1138->1145 1146 40c2ae-40c2b2 1138->1146 1142 40c215-40c233 call 3c44ed 1139->1142 1140->1142 1152 40c235-40c23b 1142->1152 1153 40c25d-40c273 call 40b791 call 3e2aae 1142->1153 1145->1096 1148 40c342-40c356 CopyFileW 1146->1148 1149 40c2b8-40c32f call 40c81d call 40c845 call 40b965 1146->1149 1150 40c358-40c365 DeleteFileW 1148->1150 1151 40c36a-40c380 DeleteFileW call 40c6d9 1148->1151 1149->1151 1170 40c331-40c340 DeleteFileW 1149->1170 1150->1096 1151->1099 1157 40c23d-40c250 call 40bf2e 1152->1157 1165 40c278-40c283 1153->1165 1166 40c252-40c25b 1157->1166 1165->1137 1169 40c289 1165->1169 1166->1153 1169->1138 1170->1096
                                                                                                    APIs
                                                                                                      • Part of subcall function 0040BDB4: __time64.LIBCMT ref: 0040BDBE
                                                                                                      • Part of subcall function 003C4517: _fseek.LIBCMT ref: 003C452F
                                                                                                    • __wsplitpath.LIBCMT ref: 0040C083
                                                                                                      • Part of subcall function 003E1DFC: __wsplitpath_helper.LIBCMT ref: 003E1E3C
                                                                                                    • _wcscpy.LIBCMT ref: 0040C096
                                                                                                    • _wcscat.LIBCMT ref: 0040C0A9
                                                                                                    • __wsplitpath.LIBCMT ref: 0040C0CE
                                                                                                    • _wcscat.LIBCMT ref: 0040C0E4
                                                                                                    • _wcscat.LIBCMT ref: 0040C0F7
                                                                                                    • _wcscmp.LIBCMT ref: 0040C03E
                                                                                                      • Part of subcall function 0040C56D: _wcscmp.LIBCMT ref: 0040C65D
                                                                                                      • Part of subcall function 0040C56D: _wcscmp.LIBCMT ref: 0040C670
                                                                                                    • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0040C2A1
                                                                                                    • DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0040C338
                                                                                                    • CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0040C34E
                                                                                                    • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0040C35F
                                                                                                    • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0040C371
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
                                                                                                    • String ID:
                                                                                                    • API String ID: 2378138488-0
                                                                                                    • Opcode ID: 746959b136e9552c76cd890e005d6c5d5181e184a35f17f1b3e6b99e90c05a13
                                                                                                    • Instruction ID: 25ec5e5915d40918e657f44c36da469a4f3ce7ffeccf48455c2098ea0f5ed597
                                                                                                    • Opcode Fuzzy Hash: 746959b136e9552c76cd890e005d6c5d5181e184a35f17f1b3e6b99e90c05a13
                                                                                                    • Instruction Fuzzy Hash: 24C13BB1D00229ABCF11DFA5CC81EDEB7BCEF49304F1041AAE609F6191DB749A448F65
                                                                                                    Function 003C3742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    • Executed
                                                                                                    • Not Executed
                                                                                                    control_flow_graph 1171 3c3742-3c3762 1173 3c3764-3c3767 1171->1173 1174 3c37c2-3c37c4 1171->1174 1175 3c37c8 1173->1175 1176 3c3769-3c3770 1173->1176 1174->1173 1177 3c37c6 1174->1177 1181 3c37ce-3c37d1 1175->1181 1182 431e00-431e2e call 3c2ff6 call 3de312 1175->1182 1178 3c382c-3c3834 PostQuitMessage 1176->1178 1179 3c3776-3c377b 1176->1179 1180 3c37ab-3c37b3 DefWindowProcW 1177->1180 1186 3c37f2-3c37f4 1178->1186 1184 431e88-431e9c call 404ddd 1179->1184 1185 3c3781-3c3783 1179->1185 1187 3c37b9-3c37bf 1180->1187 1188 3c37f6-3c381d SetTimer RegisterWindowMessageW 1181->1188 1189 3c37d3-3c37d4 1181->1189 1217 431e33-431e3a 1182->1217 1184->1186 1210 431ea2 1184->1210 1193 3c3789-3c378e 1185->1193 1194 3c3836-3c3840 call 3deb83 1185->1194 1186->1187 1188->1186 1195 3c381f-3c382a CreatePopupMenu 1188->1195 1190 431da3-431da6 1189->1190 1191 3c37da-3c37ed KillTimer call 3c3847 call 3c390f 1189->1191 1203 431da8-431daa 1190->1203 1204 431ddc-431dfb MoveWindow 1190->1204 1191->1186 1199 3c3794-3c3799 1193->1199 1200 431e6d-431e74 1193->1200 1211 3c3845 1194->1211 1195->1186 1208 3c379f-3c37a5 1199->1208 1209 431e58-431e68 call 4055bd 1199->1209 1200->1180 1206 431e7a-431e83 call 3fa5f3 1200->1206 1212 431dcb-431dd7 SetFocus 1203->1212 1213 431dac-431daf 1203->1213 1204->1186 1206->1180 1208->1180 1208->1217 1209->1186 1210->1180 1211->1186 1212->1186 1213->1208 1218 431db5-431dc6 call 3c2ff6 1213->1218 1217->1180 1221 431e40-431e53 call 3c3847 call 3c4ffc 1217->1221 1218->1186 1221->1180
                                                                                                    APIs
                                                                                                    • DefWindowProcW.USER32(?,?,?,?), ref: 003C37B3
                                                                                                    • KillTimer.USER32(?,00000001), ref: 003C37DD
                                                                                                    • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 003C3800
                                                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003C380B
                                                                                                    • CreatePopupMenu.USER32 ref: 003C381F
                                                                                                    • PostQuitMessage.USER32(00000000), ref: 003C382E
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                                                    • String ID: TaskbarCreated
                                                                                                    • API String ID: 129472671-2362178303
                                                                                                    • Opcode ID: e0270188f3a22114d6e323cd46f7264591826e043d3cfc1e1d3996ec97dfd70f
                                                                                                    • Instruction ID: a0867102ef5f28f748fe1326f4d42e7d22d294531dfc11671dd0b5ce15c51133
                                                                                                    • Opcode Fuzzy Hash: e0270188f3a22114d6e323cd46f7264591826e043d3cfc1e1d3996ec97dfd70f
                                                                                                    • Instruction Fuzzy Hash: E3416AF5600245ABEB166F68DC4AF7E369DFB09300F00853FF902D65B0CB659E419729
                                                                                                    Function 003C3E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66windowregistryCOMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    APIs
                                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 003C3E79
                                                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 003C3E88
                                                                                                    • LoadIconW.USER32(00000063), ref: 003C3E9E
                                                                                                    • LoadIconW.USER32(000000A4), ref: 003C3EB0
                                                                                                    • LoadIconW.USER32(000000A2), ref: 003C3EC2
                                                                                                      • Part of subcall function 003C4024: LoadImageW.USER32(003C0000,00000063,00000001,00000010,00000010,00000000), ref: 003C4048
                                                                                                    • RegisterClassExW.USER32(?), ref: 003C3F30
                                                                                                      • Part of subcall function 003C3F53: GetSysColorBrush.USER32(0000000F), ref: 003C3F86
                                                                                                      • Part of subcall function 003C3F53: RegisterClassExW.USER32(00000030), ref: 003C3FB0
                                                                                                      • Part of subcall function 003C3F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003C3FC1
                                                                                                      • Part of subcall function 003C3F53: InitCommonControlsEx.COMCTL32(?), ref: 003C3FDE
                                                                                                      • Part of subcall function 003C3F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003C3FEE
                                                                                                      • Part of subcall function 003C3F53: LoadIconW.USER32(000000A9), ref: 003C4004
                                                                                                      • Part of subcall function 003C3F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003C4013
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                    • String ID: #$0$AutoIt v3
                                                                                                    • API String ID: 423443420-4155596026
                                                                                                    • Opcode ID: e0c69605996797b18734047224ebe54c8b324e9abd8a41d9ec9c5d06d1cad48b
                                                                                                    • Instruction ID: 51e381ee308b3c011b67067e87eb9c9f2f10126deebfc1c629c851e2b592ba8f
                                                                                                    • Opcode Fuzzy Hash: e0c69605996797b18734047224ebe54c8b324e9abd8a41d9ec9c5d06d1cad48b
                                                                                                    • Instruction Fuzzy Hash: D82139B4D00204ABCB019FA9EC49A9DBBB9BB49710F00893FE604A62B1D3754A418B99
                                                                                                    Function 0128BA48 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    • Executed
                                                                                                    • Not Executed
                                                                                                    control_flow_graph 1235 128ba48-128baf6 call 1289458 1238 128bafd-128bb23 call 128c958 CreateFileW 1235->1238 1241 128bb2a-128bb3a 1238->1241 1242 128bb25 1238->1242 1249 128bb3c 1241->1249 1250 128bb41-128bb5b VirtualAlloc 1241->1250 1243 128bc75-128bc79 1242->1243 1244 128bcbb-128bcbe 1243->1244 1245 128bc7b-128bc7f 1243->1245 1251 128bcc1-128bcc8 1244->1251 1247 128bc8b-128bc8f 1245->1247 1248 128bc81-128bc84 1245->1248 1252 128bc9f-128bca3 1247->1252 1253 128bc91-128bc9b 1247->1253 1248->1247 1249->1243 1254 128bb5d 1250->1254 1255 128bb62-128bb79 ReadFile 1250->1255 1256 128bcca-128bcd5 1251->1256 1257 128bd1d-128bd32 1251->1257 1260 128bcb3 1252->1260 1261 128bca5-128bcaf 1252->1261 1253->1252 1254->1243 1262 128bb7b 1255->1262 1263 128bb80-128bbc0 VirtualAlloc 1255->1263 1264 128bcd9-128bce5 1256->1264 1265 128bcd7 1256->1265 1258 128bd42-128bd4a 1257->1258 1259 128bd34-128bd3f VirtualFree 1257->1259 1259->1258 1260->1244 1261->1260 1262->1243 1268 128bbc2 1263->1268 1269 128bbc7-128bbe2 call 128cba8 1263->1269 1266 128bcf9-128bd05 1264->1266 1267 128bce7-128bcf7 1264->1267 1265->1257 1272 128bd12-128bd18 1266->1272 1273 128bd07-128bd10 1266->1273 1271 128bd1b 1267->1271 1268->1243 1275 128bbed-128bbf7 1269->1275 1271->1251 1272->1271 1273->1271 1276 128bbf9-128bc28 call 128cba8 1275->1276 1277 128bc2a-128bc3e call 128c9b8 1275->1277 1276->1275 1283 128bc40 1277->1283 1284 128bc42-128bc46 1277->1284 1283->1243 1285 128bc48-128bc4c CloseHandle 1284->1285 1286 128bc52-128bc56 1284->1286 1285->1286 1287 128bc58-128bc63 VirtualFree 1286->1287 1288 128bc66-128bc6f 1286->1288 1287->1288 1288->1238 1288->1243
                                                                                                    APIs
                                                                                                    • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 0128BB19
                                                                                                    • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0128BD3F
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1304165214.0000000001289000.00000040.00000020.00020000.00000000.sdmp, Offset: 01289000, based on PE: false
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_1289000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CreateFileFreeVirtual
                                                                                                    • String ID:
                                                                                                    • API String ID: 204039940-0
                                                                                                    • Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                                                                                    • Instruction ID: 00d1cee8b7f027901f30d1bf757630a4da719a9ae34d08cf3fcb813c8804b21d
                                                                                                    • Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                                                                                    • Instruction Fuzzy Hash: 01A10674E11209EBDB14DFA8C999BEEBBB5FF48304F208159E611BB2C0D7759A40CB54
                                                                                                    Function 003C49FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73registryCOMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    • Executed
                                                                                                    • Not Executed
                                                                                                    control_flow_graph 1344 3c49fb-3c4a25 call 3cbcce RegOpenKeyExW 1347 3c4a2b-3c4a2f 1344->1347 1348 4341cc-4341e3 RegQueryValueExW 1344->1348 1349 434246-43424f RegCloseKey 1348->1349 1350 4341e5-434222 call 3df4ea call 3c47b7 RegQueryValueExW 1348->1350 1355 434224-43423b call 3c6a63 1350->1355 1356 43423d-434245 call 3c47e2 1350->1356 1355->1356 1356->1349
                                                                                                    APIs
                                                                                                    • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 003C4A1D
                                                                                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 004341DB
                                                                                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0043421A
                                                                                                    • RegCloseKey.ADVAPI32(?), ref: 00434249
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: QueryValue$CloseOpen
                                                                                                    • String ID: Include$Software\AutoIt v3\AutoIt
                                                                                                    • API String ID: 1586453840-614718249
                                                                                                    • Opcode ID: 3237ea143b5d3003cd2a183a4028043085f3c50d25fed00d12d5af0356aa3ffd
                                                                                                    • Instruction ID: c192f6935ca49e793f446dd4611ed74ccd109cb47ac76260bb00af17a50aae4c
                                                                                                    • Opcode Fuzzy Hash: 3237ea143b5d3003cd2a183a4028043085f3c50d25fed00d12d5af0356aa3ffd
                                                                                                    • Instruction Fuzzy Hash: A9116A75A00108BEEB11ABA4CD86EEFBBBCEF05348F100069B506E7191EA74AE05DB54
                                                                                                    Function 003C36B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    • Executed
                                                                                                    • Not Executed
                                                                                                    control_flow_graph 1371 3c36b8-3c3728 CreateWindowExW * 2 ShowWindow * 2
                                                                                                    APIs
                                                                                                    • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 003C36E6
                                                                                                    • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 003C3707
                                                                                                    • ShowWindow.USER32(00000000,?,?,?,?,003C3AA3,?), ref: 003C371B
                                                                                                    • ShowWindow.USER32(00000000,?,?,?,?,003C3AA3,?), ref: 003C3724
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$CreateShow
                                                                                                    • String ID: AutoIt v3$edit
                                                                                                    • API String ID: 1584632944-3779509399
                                                                                                    • Opcode ID: 6a4bdf74c7eeada37d2820ea38e7afc0470cc11d5366ce3612e178f43397e4f8
                                                                                                    • Instruction ID: 0481161bd1ea7cb943ba25a91629473041e2238515b1a0566447a27146efaa9a
                                                                                                    • Opcode Fuzzy Hash: 6a4bdf74c7eeada37d2820ea38e7afc0470cc11d5366ce3612e178f43397e4f8
                                                                                                    • Instruction Fuzzy Hash: D2F03A74D402D07AE7315757AC48E6B2E7DDBC7F20B00042FBA04A21B0C2650886EBB8
                                                                                                    Function 0128B808 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 150fileCOMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    • Executed
                                                                                                    • Not Executed
                                                                                                    control_flow_graph 1476 128b808-128b949 call 1289458 call 128b6f8 CreateFileW 1483 128b94b 1476->1483 1484 128b950-128b960 1476->1484 1485 128ba00-128ba05 1483->1485 1487 128b962 1484->1487 1488 128b967-128b981 VirtualAlloc 1484->1488 1487->1485 1489 128b983 1488->1489 1490 128b985-128b99c ReadFile 1488->1490 1489->1485 1491 128b99e 1490->1491 1492 128b9a0-128b9da call 128b738 call 128a6f8 1490->1492 1491->1485 1497 128b9dc-128b9f1 call 128b788 1492->1497 1498 128b9f6-128b9fe ExitProcess 1492->1498 1497->1498 1498->1485
                                                                                                    APIs
                                                                                                      • Part of subcall function 0128B6F8: Sleep.KERNELBASE(000001F4), ref: 0128B709
                                                                                                    • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0128B93F
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1304165214.0000000001289000.00000040.00000020.00020000.00000000.sdmp, Offset: 01289000, based on PE: false
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_1289000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CreateFileSleep
                                                                                                    • String ID: NCOU4AYHN04LODRQ9Z10DGO8H0
                                                                                                    • API String ID: 2694422964-2187890370
                                                                                                    • Opcode ID: a5deacc44f7d2f9fda4179d1036fe5edf6010b3322900b11733b65e1f517dfdd
                                                                                                    • Instruction ID: 067912629b2cd1111f5144ab2c54538710a700cba39b0180c6f53190d8418f94
                                                                                                    • Opcode Fuzzy Hash: a5deacc44f7d2f9fda4179d1036fe5edf6010b3322900b11733b65e1f517dfdd
                                                                                                    • Instruction Fuzzy Hash: F6519230D1528DDAEF12D7B8C858BEEBB74AF19304F044199E2497B2C1C7B91B49CB66
                                                                                                    Function 003C4A30 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON
                                                                                                    Download Yara Rule

                                                                                                    Control-flow Graph

                                                                                                    APIs
                                                                                                      • Part of subcall function 003C5374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00481148,?,003C61FF,?,00000000,00000001,00000000), ref: 003C5392
                                                                                                      • Part of subcall function 003C49FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 003C4A1D
                                                                                                    • _wcscat.LIBCMT ref: 00432D80
                                                                                                    • _wcscat.LIBCMT ref: 00432DB5
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _wcscat$FileModuleNameOpen
                                                                                                    • String ID: 8!H$\$\Include\
                                                                                                    • API String ID: 3592542968-2395648988
                                                                                                    • Opcode ID: 276f562a5d38bf2162e356c2cb57dd1ccc0caf375ffebf7e11bb9acc632933d7
                                                                                                    • Instruction ID: 3c73b5cf2c477dd7141552445510854449fb60499abbe2c992afa433f45f545a
                                                                                                    • Opcode Fuzzy Hash: 276f562a5d38bf2162e356c2cb57dd1ccc0caf375ffebf7e11bb9acc632933d7
                                                                                                    • Instruction Fuzzy Hash: 1F5190714043409BC315EF59DA8699EB3F4FF49300B60493EF688DB261EBB49A48CB5A
                                                                                                    Function 003C51AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 003C522F
                                                                                                    • _wcscpy.LIBCMT ref: 003C5283
                                                                                                    • Shell_NotifyIconW.SHELL32(00000001,?), ref: 003C5293
                                                                                                    • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00433CB0
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: IconLoadNotifyShell_String_memset_wcscpy
                                                                                                    • String ID: Line:
                                                                                                    • API String ID: 1053898822-1585850449
                                                                                                    • Opcode ID: 1a742c919558ab85fffa4527db04c6feaf60a10d8e027922e7a5e4abaab6f92d
                                                                                                    • Instruction ID: 70a798c965f19e34c52dd92b63f768bd8159f232ec2775d7039c2f0650c44c9f
                                                                                                    • Opcode Fuzzy Hash: 1a742c919558ab85fffa4527db04c6feaf60a10d8e027922e7a5e4abaab6f92d
                                                                                                    • Instruction Fuzzy Hash: F431BE71408740AAD722EB60DC46FDF77DCAB45310F00492FF589D61A1EB74AA89CB9A
                                                                                                    Function 003C4139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C41A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,003C39FE,?,00000001), ref: 003C41DB
                                                                                                    • _free.LIBCMT ref: 004336B7
                                                                                                    • _free.LIBCMT ref: 004336FE
                                                                                                      • Part of subcall function 003CC833: __wsplitpath.LIBCMT ref: 003CC93E
                                                                                                      • Part of subcall function 003CC833: _wcscpy.LIBCMT ref: 003CC953
                                                                                                      • Part of subcall function 003CC833: _wcscat.LIBCMT ref: 003CC968
                                                                                                      • Part of subcall function 003CC833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 003CC978
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
                                                                                                    • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                                                                    • API String ID: 805182592-1757145024
                                                                                                    • Opcode ID: 010388fee8fcb3ccc1ed1e20679ae387c9cd83ba534f42765835c594b052cc22
                                                                                                    • Instruction ID: e063ac6479f738169e602894592af410cb8337215b54cf9b11098d03bf667c55
                                                                                                    • Opcode Fuzzy Hash: 010388fee8fcb3ccc1ed1e20679ae387c9cd83ba534f42765835c594b052cc22
                                                                                                    • Instruction Fuzzy Hash: 0A915C71910219AFCF15EFA5CC92AEEB7B4BF18310F10442AF816EB291DB349E05CB54
                                                                                                    Function 003C40E5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 00433725
                                                                                                    • GetOpenFileNameW.COMDLG32 ref: 0043376F
                                                                                                      • Part of subcall function 003C660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003C53B1,?,?,003C61FF,?,00000000,00000001,00000000), ref: 003C662F
                                                                                                      • Part of subcall function 003C40A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003C40C6
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Name$Path$FileFullLongOpen_memset
                                                                                                    • String ID: X$t3G
                                                                                                    • API String ID: 3777226403-2923051761
                                                                                                    • Opcode ID: ea3a1c5da82d1e64223bea15b19ab9af3bc920fbf0530c6da999cc8c5f5874f9
                                                                                                    • Instruction ID: 382a059b7839ecab6f1f7d27b1c01ba32ad12a85b9f8364edfb60346e85fb935
                                                                                                    • Opcode Fuzzy Hash: ea3a1c5da82d1e64223bea15b19ab9af3bc920fbf0530c6da999cc8c5f5874f9
                                                                                                    • Instruction Fuzzy Hash: A7219371A102989BCB12DFD4C845BDEBBFC9F49305F00805EE505EB241DBB89A898F65
                                                                                                    Function 003E34AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __getstream.LIBCMT ref: 003E34FE
                                                                                                      • Part of subcall function 003E7C0E: __getptd_noexit.LIBCMT ref: 003E7C0E
                                                                                                    • @_EH4_CallFilterFunc@8.LIBCMT ref: 003E3539
                                                                                                    • __wopenfile.LIBCMT ref: 003E3549
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
                                                                                                    • String ID: <G
                                                                                                    • API String ID: 1820251861-2138716496
                                                                                                    • Opcode ID: fcfd1f8ca6ae102dd9fb7f8acd68f7528b464c36f9c9bffc88903818e0930e47
                                                                                                    • Instruction ID: 5ad423c74f4759bad3d5175cb49584c5a27c8aac521fe9f160cf47ec8fcd0364
                                                                                                    • Opcode Fuzzy Hash: fcfd1f8ca6ae102dd9fb7f8acd68f7528b464c36f9c9bffc88903818e0930e47
                                                                                                    • Instruction Fuzzy Hash: 0711E770A002B6DADB13BF778C4276E36E8AF45350F168725E415DF2C1EB34CA019BA1
                                                                                                    Function 003DD298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,003DD28B,SwapMouseButtons,00000004,?), ref: 003DD2BC
                                                                                                    • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,003DD28B,SwapMouseButtons,00000004,?,?,?,?,003DC865), ref: 003DD2DD
                                                                                                    • RegCloseKey.KERNELBASE(00000000,?,?,003DD28B,SwapMouseButtons,00000004,?,?,?,?,003DC865), ref: 003DD2FF
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CloseOpenQueryValue
                                                                                                    • String ID: Control Panel\Mouse
                                                                                                    • API String ID: 3677997916-824357125
                                                                                                    • Opcode ID: f812f7bd87584a0be7c7dadb99ee2184e7b4db770c0f3a7da91ee17f96a012a0
                                                                                                    • Instruction ID: c9bc91abfa2293812d0f708345f2905e5be7ba156e83afec8262934d2a74437f
                                                                                                    • Opcode Fuzzy Hash: f812f7bd87584a0be7c7dadb99ee2184e7b4db770c0f3a7da91ee17f96a012a0
                                                                                                    • Instruction Fuzzy Hash: 2E113C7AA11208BFDB218F64EC84EAF7BBCEF45744F10486AE805D7210D7319E459B64
                                                                                                    Function 0128A6F8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CreateProcessW.KERNELBASE(?,00000000), ref: 0128AEB3
                                                                                                    • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0128AF49
                                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0128AF6B
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1304165214.0000000001289000.00000040.00000020.00020000.00000000.sdmp, Offset: 01289000, based on PE: false
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_1289000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                    • String ID:
                                                                                                    • API String ID: 2438371351-0
                                                                                                    • Opcode ID: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
                                                                                                    • Instruction ID: 90149cea77c2a6b7f37c2a8c64a47b47217336b4d8426c38381eabce1bad435b
                                                                                                    • Opcode Fuzzy Hash: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
                                                                                                    • Instruction Fuzzy Hash: DF620C30A25218DBEB24DBA4C841BDEB771EF58300F1091A9D20DEB3D4E7769E81CB59
                                                                                                    Function 003E365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _memset$__filbuf__getptd_noexit_memcpy_s
                                                                                                    • String ID:
                                                                                                    • API String ID: 3877424927-0
                                                                                                    • Opcode ID: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
                                                                                                    • Instruction ID: 63dba9d0a416645da52a7277bfdefb76cd80c7a877d1a381a4b94ba937e14012
                                                                                                    • Opcode Fuzzy Hash: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
                                                                                                    • Instruction Fuzzy Hash: 8851CAB0A003A5EBDB268F7B888966E77B5AF40320F25872DF825976D0D7719F508B40
                                                                                                    Function 0040C396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C4517: _fseek.LIBCMT ref: 003C452F
                                                                                                      • Part of subcall function 0040C56D: _wcscmp.LIBCMT ref: 0040C65D
                                                                                                      • Part of subcall function 0040C56D: _wcscmp.LIBCMT ref: 0040C670
                                                                                                    • _free.LIBCMT ref: 0040C4DD
                                                                                                    • _free.LIBCMT ref: 0040C4E4
                                                                                                    • _free.LIBCMT ref: 0040C54F
                                                                                                      • Part of subcall function 003E1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,003E7A85), ref: 003E1CB1
                                                                                                      • Part of subcall function 003E1C9D: GetLastError.KERNEL32(00000000,?,003E7A85), ref: 003E1CC3
                                                                                                    • _free.LIBCMT ref: 0040C557
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                                                                    • String ID:
                                                                                                    • API String ID: 1552873950-0
                                                                                                    • Opcode ID: 2db9d723d2f1f24614347a7e6fc8c80c315d14cd5ac174f49895e1fbecc6b5fc
                                                                                                    • Instruction ID: e07c06127d3189ae3bc7315199e7c36864c7c30d228b58418dbe2e5fc8ac3d51
                                                                                                    • Opcode Fuzzy Hash: 2db9d723d2f1f24614347a7e6fc8c80c315d14cd5ac174f49895e1fbecc6b5fc
                                                                                                    • Instruction Fuzzy Hash: 9D516EB1904218AFDF159F65DC81BAEBBB9EF48304F1001AEB209F7281DB755E808F59
                                                                                                    Function 003DEB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 003DEBB2
                                                                                                      • Part of subcall function 003C51AF: _memset.LIBCMT ref: 003C522F
                                                                                                      • Part of subcall function 003C51AF: _wcscpy.LIBCMT ref: 003C5283
                                                                                                      • Part of subcall function 003C51AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 003C5293
                                                                                                    • KillTimer.USER32(?,00000001,?,?), ref: 003DEC07
                                                                                                    • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 003DEC16
                                                                                                    • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00433C88
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                                                                    • String ID:
                                                                                                    • API String ID: 1378193009-0
                                                                                                    • Opcode ID: da7b0d2dfefbac070439891b963095c0e6ac85a65882c1fc854e8f448f3c35b2
                                                                                                    • Instruction ID: 9b5e599cdb95e8aefa374aa64e00108e699c65a37606abee088f9f17df150aad
                                                                                                    • Opcode Fuzzy Hash: da7b0d2dfefbac070439891b963095c0e6ac85a65882c1fc854e8f448f3c35b2
                                                                                                    • Instruction Fuzzy Hash: CA212C759047849FE7339B24DC59BE7BFEC9B06308F04145EE68E5B241C3742A85CB15
                                                                                                    Function 0040C71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetTempPathW.KERNEL32(00000104,?), ref: 0040C72F
                                                                                                    • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0040C746
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Temp$FileNamePath
                                                                                                    • String ID: aut
                                                                                                    • API String ID: 3285503233-3010740371
                                                                                                    • Opcode ID: b5d0f284f31716f0c63d6502f8d4016f45cd185f876ff5fc53f7dd4cef1b2455
                                                                                                    • Instruction ID: 14b205c57a2c9b0f3ed346defd62daadbec76cfd14da0163f623ca8afafdcffa
                                                                                                    • Opcode Fuzzy Hash: b5d0f284f31716f0c63d6502f8d4016f45cd185f876ff5fc53f7dd4cef1b2455
                                                                                                    • Instruction Fuzzy Hash: A4D05EB590030EABDB50ABA0DC0EFCA776CA700704F0001A1B754A50B1DAF4E6998B5A
                                                                                                    Function 0041F8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: 1d61d3be6fe7dcd1d14216b58493806ef238356468983a7a78669e7eb6f9e614
                                                                                                    • Instruction ID: d4a2ee7b4c79bc60166b638f7b94a8921f76a5cb3ebf68627ba05f6bb6cc10e8
                                                                                                    • Opcode Fuzzy Hash: 1d61d3be6fe7dcd1d14216b58493806ef238356468983a7a78669e7eb6f9e614
                                                                                                    • Instruction Fuzzy Hash: 47F16C716083019FC710DF24C885B6AB7E5FF88314F14892EF9999B392D734E94ACB86
                                                                                                    Function 003C4FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 003C5022
                                                                                                    • Shell_NotifyIconW.SHELL32(00000000,?), ref: 003C50CB
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: IconNotifyShell__memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 928536360-0
                                                                                                    • Opcode ID: 934bb88afd3693368f155a14818793a0158b6596f6dbd6956e854b9de6022a2e
                                                                                                    • Instruction ID: e179d2ed118e4d592a21f53e7ed35063534cf1a902afdfce319b06d8129e52bb
                                                                                                    • Opcode Fuzzy Hash: 934bb88afd3693368f155a14818793a0158b6596f6dbd6956e854b9de6022a2e
                                                                                                    • Instruction Fuzzy Hash: A631AEB1504710CFC722EF24D884B9BBBE8FF49308F00092EE59AC6251E7716984CB9A
                                                                                                    Function 003E395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __FF_MSGBANNER.LIBCMT ref: 003E3973
                                                                                                      • Part of subcall function 003E81C2: __NMSG_WRITE.LIBCMT ref: 003E81E9
                                                                                                      • Part of subcall function 003E81C2: __NMSG_WRITE.LIBCMT ref: 003E81F3
                                                                                                    • __NMSG_WRITE.LIBCMT ref: 003E397A
                                                                                                      • Part of subcall function 003E821F: GetModuleFileNameW.KERNEL32(00000000,00480312,00000104,00000000,00000001,00000000), ref: 003E82B1
                                                                                                      • Part of subcall function 003E821F: ___crtMessageBoxW.LIBCMT ref: 003E835F
                                                                                                      • Part of subcall function 003E1145: ___crtCorExitProcess.LIBCMT ref: 003E114B
                                                                                                      • Part of subcall function 003E1145: ExitProcess.KERNEL32 ref: 003E1154
                                                                                                      • Part of subcall function 003E7C0E: __getptd_noexit.LIBCMT ref: 003E7C0E
                                                                                                    • RtlAllocateHeap.NTDLL(01040000,00000000,00000001,00000001,00000000,?,?,003DF507,?,0000000E), ref: 003E399F
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                                                                    • String ID:
                                                                                                    • API String ID: 1372826849-0
                                                                                                    • Opcode ID: 7ccfc09c8c168d12de25baa67440f69706f3dea3ff653e477531790b7308b218
                                                                                                    • Instruction ID: 5cb3885137c31a65ecce3b35bd2bf07e7601e4555e70ee809ca6a42f67d04fc9
                                                                                                    • Opcode Fuzzy Hash: 7ccfc09c8c168d12de25baa67440f69706f3dea3ff653e477531790b7308b218
                                                                                                    • Instruction Fuzzy Hash: 7C0196762452B19AE6133B2BDC4AB2E239C9B81760F620339F5059F2D3DBB09D004664
                                                                                                    Function 0040C6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,0040C385,?,?,?,?,?,00000004), ref: 0040C6F2
                                                                                                    • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,0040C385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 0040C708
                                                                                                    • CloseHandle.KERNEL32(00000000,?,0040C385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0040C70F
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: File$CloseCreateHandleTime
                                                                                                    • String ID:
                                                                                                    • API String ID: 3397143404-0
                                                                                                    • Opcode ID: 64511f652a229b25692b3fd9f5ff99a139d3378198a6351e30fc4481bf3f22b9
                                                                                                    • Instruction ID: e10eaec1f6439be0a37e4fc613055976fd91b4521eb6f583bf3d16c3b000d9ff
                                                                                                    • Opcode Fuzzy Hash: 64511f652a229b25692b3fd9f5ff99a139d3378198a6351e30fc4481bf3f22b9
                                                                                                    • Instruction Fuzzy Hash: B4E08636541214B7E7211F54AC09FCA7B18AB46B60F104220FF14790E097B12511879C
                                                                                                    Function 0040BB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _free.LIBCMT ref: 0040BB72
                                                                                                      • Part of subcall function 003E1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,003E7A85), ref: 003E1CB1
                                                                                                      • Part of subcall function 003E1C9D: GetLastError.KERNEL32(00000000,?,003E7A85), ref: 003E1CC3
                                                                                                    • _free.LIBCMT ref: 0040BB83
                                                                                                    • _free.LIBCMT ref: 0040BB95
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                                    • String ID:
                                                                                                    • API String ID: 776569668-0
                                                                                                    • Opcode ID: 9be2b5beef45e3014043d3abdf219173afad32993680376f9e1db3d5b0d03a7e
                                                                                                    • Instruction ID: 7c1eaab4a20a40d97f66f1c6e409ef7886cad37ffd9c68038d946faeb04fee56
                                                                                                    • Opcode Fuzzy Hash: 9be2b5beef45e3014043d3abdf219173afad32993680376f9e1db3d5b0d03a7e
                                                                                                    • Instruction Fuzzy Hash: 37E012B164179147DA25657A6E48EB323DC8F04355724092EB859FB7C6CF38F84085EC
                                                                                                    Function 003C2322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C22A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,003C24F1), ref: 003C2303
                                                                                                    • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 003C25A1
                                                                                                    • CoInitialize.OLE32(00000000), ref: 003C2618
                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0043503A
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Handle$CloseInitializeMessageRegisterWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 3815369404-0
                                                                                                    • Opcode ID: 654774f16aa1f8c2b28cba44be3161875e06094d28379445296ee1f104439835
                                                                                                    • Instruction ID: ecadcb2c4c9a79310fea82d7cbf37cafbc1efceabc11e6269b74a4dc70ae8ad6
                                                                                                    • Opcode Fuzzy Hash: 654774f16aa1f8c2b28cba44be3161875e06094d28379445296ee1f104439835
                                                                                                    • Instruction Fuzzy Hash: 7D71A0B49013818BD305EF5AA99499DBBACBB58344B808DBFD519EB372CB744806CF1D
                                                                                                    Function 0040BBE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __fread_nolock
                                                                                                    • String ID: EA06
                                                                                                    • API String ID: 2638373210-3962188686
                                                                                                    • Opcode ID: 5196d4c6acb46b479e1c18c43b2a26d80b13ebe995c319a9482ff99ef5f383da
                                                                                                    • Instruction ID: e8151aa892e18a216104a6008accafd82f756cd783923c5bafcf84f5d884c79b
                                                                                                    • Opcode Fuzzy Hash: 5196d4c6acb46b479e1c18c43b2a26d80b13ebe995c319a9482ff99ef5f383da
                                                                                                    • Instruction Fuzzy Hash: 9E01F9729042587EDB19C798C856FEEBBF8DB05301F00456FF153D61C1D578A7088B60
                                                                                                    Function 00420828 Relevance: 3.2, APIs: 2, Instructions: 232COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _strcat.LIBCMT ref: 004208FD
                                                                                                      • Part of subcall function 003C936C: __swprintf.LIBCMT ref: 003C93AB
                                                                                                      • Part of subcall function 003C936C: __itow.LIBCMT ref: 003C93DF
                                                                                                    • _wcscpy.LIBCMT ref: 0042098C
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __itow__swprintf_strcat_wcscpy
                                                                                                    • String ID:
                                                                                                    • API String ID: 1012013722-0
                                                                                                    • Opcode ID: 2f9c5e2d1a429a8536fc2d15db0da3739ac2a16adaa70716ce52f62a7d8435a5
                                                                                                    • Instruction ID: dec1bbacd6f5b92a3c46d82d39f7de4e79f69df18b7768d08e10aa95c1a37765
                                                                                                    • Opcode Fuzzy Hash: 2f9c5e2d1a429a8536fc2d15db0da3739ac2a16adaa70716ce52f62a7d8435a5
                                                                                                    • Instruction Fuzzy Hash: 10913635B00614DFCB19DF18D491AA9B7E5EF59310B91806EF81A8F3A2DB34ED42CB84
                                                                                                    Function 003C3A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • IsThemeActive.UXTHEME ref: 003C3A73
                                                                                                      • Part of subcall function 003E1405: __lock.LIBCMT ref: 003E140B
                                                                                                      • Part of subcall function 003C3ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 003C3AF3
                                                                                                      • Part of subcall function 003C3ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 003C3B08
                                                                                                      • Part of subcall function 003C3D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,003C3AA3,?), ref: 003C3D45
                                                                                                      • Part of subcall function 003C3D19: IsDebuggerPresent.KERNEL32(?,?,?,?,003C3AA3,?), ref: 003C3D57
                                                                                                      • Part of subcall function 003C3D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00481148,00481130,?,?,?,?,003C3AA3,?), ref: 003C3DC8
                                                                                                      • Part of subcall function 003C3D19: SetCurrentDirectoryW.KERNEL32(?,?,?,003C3AA3,?), ref: 003C3E48
                                                                                                    • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 003C3AB3
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
                                                                                                    • String ID:
                                                                                                    • API String ID: 924797094-0
                                                                                                    • Opcode ID: dde547929f0977d618c1302d15d4652a84ae51003f3e32cc0d4577e499cd70ba
                                                                                                    • Instruction ID: 8a603d1068a415e1de8bf80b0004b1ec80fafac64477e1a41cc14339d430e3dc
                                                                                                    • Opcode Fuzzy Hash: dde547929f0977d618c1302d15d4652a84ae51003f3e32cc0d4577e499cd70ba
                                                                                                    • Instruction Fuzzy Hash: 6B11AE719043409BC301EF26EC45A1EBBE8EF95710F00892FF484872B1DB708A41CB96
                                                                                                    Function 003EE9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • ___lock_fhandle.LIBCMT ref: 003EEA29
                                                                                                    • __close_nolock.LIBCMT ref: 003EEA42
                                                                                                      • Part of subcall function 003E7BDA: __getptd_noexit.LIBCMT ref: 003E7BDA
                                                                                                      • Part of subcall function 003E7C0E: __getptd_noexit.LIBCMT ref: 003E7C0E
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __getptd_noexit$___lock_fhandle__close_nolock
                                                                                                    • String ID:
                                                                                                    • API String ID: 1046115767-0
                                                                                                    • Opcode ID: 91f49322c64e072bf368e705577edc4032d1232e26000ceccec6fc504566a77b
                                                                                                    • Instruction ID: 60f538b080abc23169b1ee8251c618dd797d56f1da8293bb73a91e2df1494896
                                                                                                    • Opcode Fuzzy Hash: 91f49322c64e072bf368e705577edc4032d1232e26000ceccec6fc504566a77b
                                                                                                    • Instruction Fuzzy Hash: BE11A572805AF18AD713BF6AD84235D7A616F81331F264768E4245F2E3DBB48C4097A5
                                                                                                    Function 003DF4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003E395C: __FF_MSGBANNER.LIBCMT ref: 003E3973
                                                                                                      • Part of subcall function 003E395C: __NMSG_WRITE.LIBCMT ref: 003E397A
                                                                                                      • Part of subcall function 003E395C: RtlAllocateHeap.NTDLL(01040000,00000000,00000001,00000001,00000000,?,?,003DF507,?,0000000E), ref: 003E399F
                                                                                                    • std::exception::exception.LIBCMT ref: 003DF51E
                                                                                                    • __CxxThrowException@8.LIBCMT ref: 003DF533
                                                                                                      • Part of subcall function 003E6805: RaiseException.KERNEL32(?,?,0000000E,00476A30,?,?,?,003DF538,0000000E,00476A30,?,00000001), ref: 003E6856
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                                                                    • String ID:
                                                                                                    • API String ID: 3902256705-0
                                                                                                    • Opcode ID: 716429c900e1a4d6d11c0ac461e84910f50e9feae0e9aba9597eb49be728d074
                                                                                                    • Instruction ID: 176709e49e5a11dc1babbb82b066d726653aeeb0e0daf7c798caa042779a8150
                                                                                                    • Opcode Fuzzy Hash: 716429c900e1a4d6d11c0ac461e84910f50e9feae0e9aba9597eb49be728d074
                                                                                                    • Instruction Fuzzy Hash: 1FF0A93250425D6BD706BF9AF8429EE77AD5F01354F608127F905A63C1DBB0964086A5
                                                                                                    Function 003E3839 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __lock_file_memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 26237723-0
                                                                                                    • Opcode ID: 0107013a87a6968fa2691243c6397371f1e3fe88999bfe9936daf36265adf9d2
                                                                                                    • Instruction ID: 29c192abdeb454d61fd7d28c8a51c9173d9b4a964d14089c57ee5b8ea9c84ea1
                                                                                                    • Opcode Fuzzy Hash: 0107013a87a6968fa2691243c6397371f1e3fe88999bfe9936daf36265adf9d2
                                                                                                    • Instruction Fuzzy Hash: E30171718002A9EACF23AFA68C065DF7B61EF80360F158329F8245B1E1D7718B65DB91
                                                                                                    Function 003E35E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003E7C0E: __getptd_noexit.LIBCMT ref: 003E7C0E
                                                                                                    • __lock_file.LIBCMT ref: 003E3629
                                                                                                      • Part of subcall function 003E4E1C: __lock.LIBCMT ref: 003E4E3F
                                                                                                    • __fclose_nolock.LIBCMT ref: 003E3634
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                                                                    • String ID:
                                                                                                    • API String ID: 2800547568-0
                                                                                                    • Opcode ID: 85093cbe1e937c22a872a018a2595f0e88dbcfeede886c2620e7a07988840764
                                                                                                    • Instruction ID: b190093279b733e107a1128a35f4db099932864015fcc13daf026853755cf11e
                                                                                                    • Opcode Fuzzy Hash: 85093cbe1e937c22a872a018a2595f0e88dbcfeede886c2620e7a07988840764
                                                                                                    • Instruction Fuzzy Hash: 20F024318006B0AADB137B77880B76EBAA06F51330F268308E464AF2C1CB7C8A019B55
                                                                                                    Function 0128A6F5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CreateProcessW.KERNELBASE(?,00000000), ref: 0128AEB3
                                                                                                    • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0128AF49
                                                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0128AF6B
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1304165214.0000000001289000.00000040.00000020.00020000.00000000.sdmp, Offset: 01289000, based on PE: false
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_1289000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                    • String ID:
                                                                                                    • API String ID: 2438371351-0
                                                                                                    • Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                                                                                    • Instruction ID: 6e50aec6e2c57d07f8c7d064ad31b6d1d018c1a8ef8b46ecf95ec7356750388c
                                                                                                    • Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                                                                                    • Instruction Fuzzy Hash: 5A12CE24E24658C6EB24DF64D8507DEB232EF68300F1094E9910DEB7E5E77A4E81CF5A
                                                                                                    Function 003CE8A0 Relevance: 1.7, APIs: 1, Instructions: 200windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003CE959
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessagePeek
                                                                                                    • String ID:
                                                                                                    • API String ID: 2222842502-0
                                                                                                    • Opcode ID: cb07037627781ac3bb03396972a72a88e96710b53763edec194de4e235972824
                                                                                                    • Instruction ID: 184ff75ba920d9a2a566aadcba0c85c991378418ff28339a34475e04721503d5
                                                                                                    • Opcode Fuzzy Hash: cb07037627781ac3bb03396972a72a88e96710b53763edec194de4e235972824
                                                                                                    • Instruction Fuzzy Hash: C271E8718083808FEB26CF24D889B6A7BD0BB55304F19497FD886CB3A1D7759C85CB96
                                                                                                    Function 003E2957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __flush.LIBCMT ref: 003E2A0B
                                                                                                      • Part of subcall function 003E7C0E: __getptd_noexit.LIBCMT ref: 003E7C0E
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __flush__getptd_noexit
                                                                                                    • String ID:
                                                                                                    • API String ID: 4101623367-0
                                                                                                    • Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                                                                    • Instruction ID: 9d2d3f57a175bd6a641b872245b3e52cb3fab3f111980fad0997538942ccdad8
                                                                                                    • Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                                                                    • Instruction Fuzzy Hash: 244193716006A69FDB2E8E6BC8815AF77AEAF44360B25873DE845CB2C1DF70DD518B40
                                                                                                    Function 003DED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ProtectVirtual
                                                                                                    • String ID:
                                                                                                    • API String ID: 544645111-0
                                                                                                    • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                    • Instruction ID: 3c252343ef9df6fe6bd7e16157adbcea683e9e0d6d2dfdec21f623597b885404
                                                                                                    • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                    • Instruction Fuzzy Hash: C531D472A001059FC71AEF58E490969FBB6FB49340B6586A6E409CF756DB30EDC1CB90
                                                                                                    Function 0042040F Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _free
                                                                                                    • String ID:
                                                                                                    • API String ID: 269201875-0
                                                                                                    • Opcode ID: c6c846b4e03735e4b6dabbeda05d845e5c218f9748894307a68d3d0b44007a3c
                                                                                                    • Instruction ID: 03a92adac2a2d3df457436b2fdf5b1ca8c7bcd48a16d1eb9c7fcb4725c876f09
                                                                                                    • Opcode Fuzzy Hash: c6c846b4e03735e4b6dabbeda05d845e5c218f9748894307a68d3d0b44007a3c
                                                                                                    • Instruction Fuzzy Hash: B131AF76204524DFCB01EF00E09066EB7B0FF48324F60845BEA956F396DB78A942CF86
                                                                                                    Function 00439A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ClearVariant
                                                                                                    • String ID:
                                                                                                    • API String ID: 1473721057-0
                                                                                                    • Opcode ID: 818a6bd6d9d426adfd48abefaaaf1df3d28af85c0e86e20228ac210877ffec58
                                                                                                    • Instruction ID: c4db675570d91f43bcb170965d9de9a3546e5d899fa1ce1e1a1d5d6e5a82dffb
                                                                                                    • Opcode Fuzzy Hash: 818a6bd6d9d426adfd48abefaaaf1df3d28af85c0e86e20228ac210877ffec58
                                                                                                    • Instruction Fuzzy Hash: 12417C715046018FDB25CF28D084B1ABBE1BF45308F1989AEE99A4B362C376FC45CF42
                                                                                                    Function 003EED06 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __getptd_noexit
                                                                                                    • String ID:
                                                                                                    • API String ID: 3074181302-0
                                                                                                    • Opcode ID: 01994aea39490a93fa7c87de6ab3eb93e6804ed55cd2610f43f79317517fd679
                                                                                                    • Instruction ID: 80976ac0173212c92aabc7d0f0e132ccd76c735f9f3c1a664612c813a11bdaab
                                                                                                    • Opcode Fuzzy Hash: 01994aea39490a93fa7c87de6ab3eb93e6804ed55cd2610f43f79317517fd679
                                                                                                    • Instruction Fuzzy Hash: 7C218E72804AF18FD713BFAACC4635A3A65AF81336F260750E4304F1E2DBB48C008BA5
                                                                                                    Function 003C41A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C4214: FreeLibrary.KERNEL32(00000000,?), ref: 003C4247
                                                                                                    • LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,003C39FE,?,00000001), ref: 003C41DB
                                                                                                      • Part of subcall function 003C4291: FreeLibrary.KERNEL32(00000000), ref: 003C42C4
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Library$Free$Load
                                                                                                    • String ID:
                                                                                                    • API String ID: 2391024519-0
                                                                                                    • Opcode ID: c3a927c6635338365ff4a2b5b5d1d56ff89ca3bbd3f45336647c0d17a57ee178
                                                                                                    • Instruction ID: e69b3a3d52eb9e545b339523a27cb514ed68ffd76912bbab782b2275e763c886
                                                                                                    • Opcode Fuzzy Hash: c3a927c6635338365ff4a2b5b5d1d56ff89ca3bbd3f45336647c0d17a57ee178
                                                                                                    • Instruction Fuzzy Hash: C911E331600206AACB12BB71DC27F9E77A99F80700F10882EF596EA1C1DB74DE009B64
                                                                                                    Function 00439B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ClearVariant
                                                                                                    • String ID:
                                                                                                    • API String ID: 1473721057-0
                                                                                                    • Opcode ID: 3c836f488f00bb18ad2496f2ecbb1db46578bf7ac6e024a406f9fb5d5c4d831f
                                                                                                    • Instruction ID: 419c5665985cfd6004bcd96535e9ac9a26898bb16a5041e2671619d43a4afa3e
                                                                                                    • Opcode Fuzzy Hash: 3c836f488f00bb18ad2496f2ecbb1db46578bf7ac6e024a406f9fb5d5c4d831f
                                                                                                    • Instruction Fuzzy Hash: 3A216971508301CFDB26DF24E484B2ABBE2BF85304F15496EE9964B722C732E855CF52
                                                                                                    Function 003EAF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • ___lock_fhandle.LIBCMT ref: 003EAFC0
                                                                                                      • Part of subcall function 003E7BDA: __getptd_noexit.LIBCMT ref: 003E7BDA
                                                                                                      • Part of subcall function 003E7C0E: __getptd_noexit.LIBCMT ref: 003E7C0E
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __getptd_noexit$___lock_fhandle
                                                                                                    • String ID:
                                                                                                    • API String ID: 1144279405-0
                                                                                                    • Opcode ID: 590f74cd458c4e26783fbaf60cb0277045de495d3dd5f240bb54f0e6264bb1dc
                                                                                                    • Instruction ID: 9753ca2f83b38d818d1607c3a373002c24465a6e52525184d42b71df5fdafe86
                                                                                                    • Opcode Fuzzy Hash: 590f74cd458c4e26783fbaf60cb0277045de495d3dd5f240bb54f0e6264bb1dc
                                                                                                    • Instruction Fuzzy Hash: 1211BF72804AF08FD7136FA6980236EBA60AF41331F264750E4741F1E3C7B4AD008BA2
                                                                                                    Function 003C39DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: LibraryLoad
                                                                                                    • String ID:
                                                                                                    • API String ID: 1029625771-0
                                                                                                    • Opcode ID: 6835a613e9910970744cf47f90ff2063449a5087be5f2ce099398601ed1c7b70
                                                                                                    • Instruction ID: 85ed56ae73b3c108c27f0ff735d982c7dd91519826f0ebd3108d9d80b5b573d4
                                                                                                    • Opcode Fuzzy Hash: 6835a613e9910970744cf47f90ff2063449a5087be5f2ce099398601ed1c7b70
                                                                                                    • Instruction Fuzzy Hash: 5B013131500109AECF06EFA4C992DFEBB78EF24344F10812AB566D71A5EA309E49DB64
                                                                                                    Function 003E2AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __lock_file.LIBCMT ref: 003E2AED
                                                                                                      • Part of subcall function 003E7C0E: __getptd_noexit.LIBCMT ref: 003E7C0E
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __getptd_noexit__lock_file
                                                                                                    • String ID:
                                                                                                    • API String ID: 2597487223-0
                                                                                                    • Opcode ID: 629412371fa4fa34920f96cb87a664d385a14cf5b938e7cd596303d24c7d5b84
                                                                                                    • Instruction ID: d820363eac632d22912d5f8c67a83a48e9ad0e86bed17ae1dd6602547cb7c071
                                                                                                    • Opcode Fuzzy Hash: 629412371fa4fa34920f96cb87a664d385a14cf5b938e7cd596303d24c7d5b84
                                                                                                    • Instruction Fuzzy Hash: 44F0C2319002A5EADF23AF678C0239F36A9BF40310F158625B4149F1D1CB788A52DB51
                                                                                                    Function 003C4252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • FreeLibrary.KERNEL32(?,?,?,?,?,003C39FE,?,00000001), ref: 003C4286
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: FreeLibrary
                                                                                                    • String ID:
                                                                                                    • API String ID: 3664257935-0
                                                                                                    • Opcode ID: 25210084391a3fd82d31ba37bb9300ad7bf9da127f54f3deaf6aa268c64c0f80
                                                                                                    • Instruction ID: 570f43cac360198516598204cdd5c56659b501b27f5e405a279748ac1027d3be
                                                                                                    • Opcode Fuzzy Hash: 25210084391a3fd82d31ba37bb9300ad7bf9da127f54f3deaf6aa268c64c0f80
                                                                                                    • Instruction Fuzzy Hash: C0F01571505712CFCB369F65D8A5D66BBF4AF053253258E3EF1D682A10C7329C40DB50
                                                                                                    Function 003C40A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003C40C6
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: LongNamePath
                                                                                                    • String ID:
                                                                                                    • API String ID: 82841172-0
                                                                                                    • Opcode ID: 0600d0714b712752b8a7621f352cf9c132042592e46c6a899998911de5ba0fb8
                                                                                                    • Instruction ID: fe3c83e632c005549efba2bfb9641799dc4345099c3a1b787dd7448c8ca3782a
                                                                                                    • Opcode Fuzzy Hash: 0600d0714b712752b8a7621f352cf9c132042592e46c6a899998911de5ba0fb8
                                                                                                    • Instruction Fuzzy Hash: 30E0CD766001245BC7129754CC46FEA779DDFC8690F050175F905D7244D964DD818690
                                                                                                    Function 0040BCF4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __fread_nolock
                                                                                                    • String ID:
                                                                                                    • API String ID: 2638373210-0
                                                                                                    • Opcode ID: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
                                                                                                    • Instruction ID: 1164d597e6df14e4edafea9c98138fb550358b088055e3514a2d2fc74374528a
                                                                                                    • Opcode Fuzzy Hash: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
                                                                                                    • Instruction Fuzzy Hash: E7E092B0104B409BD7358B24D800BE3B3E0EF05305F00091DF29A93381EB627841865D
                                                                                                    Function 0128B6F8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • Sleep.KERNELBASE(000001F4), ref: 0128B709
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1304165214.0000000001289000.00000040.00000020.00020000.00000000.sdmp, Offset: 01289000, based on PE: false
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_1289000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Sleep
                                                                                                    • String ID:
                                                                                                    • API String ID: 3472027048-0
                                                                                                    • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                    • Instruction ID: 9db27ab5bf38de57852da39d47e27207bb58e9c10dafea6f3f331e618f7032a2
                                                                                                    • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                    • Instruction Fuzzy Hash: A1E0E67594120EDFDB00EFB4D5496AD7BF4EF04301F100165FD01D2280D6309D508A62

                                                                                                    Non-executed Functions

                                                                                                    Function 0042AACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0042B1CD
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend
                                                                                                    • String ID: %d/%02d/%02d
                                                                                                    • API String ID: 3850602802-328681919
                                                                                                    • Opcode ID: 997bd2b55a383bf247141650f02be801516c903e5a3484460064f2760b31840f
                                                                                                    • Instruction ID: fbfa36f91fcfb62641f8bd0da4b18fef6f484ddb44ba1ed778d352b58e1d2f3e
                                                                                                    • Opcode Fuzzy Hash: 997bd2b55a383bf247141650f02be801516c903e5a3484460064f2760b31840f
                                                                                                    • Instruction Fuzzy Hash: A612EF71600229ABEB258F64EC49FAF7BB8FF45310F10412AF915DB2D1DB788912CB59
                                                                                                    Function 003DEB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetForegroundWindow.USER32(00000000,00000000), ref: 003DEB4A
                                                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00433AEA
                                                                                                    • IsIconic.USER32(000000FF), ref: 00433AF3
                                                                                                    • ShowWindow.USER32(000000FF,00000009), ref: 00433B00
                                                                                                    • SetForegroundWindow.USER32(000000FF), ref: 00433B0A
                                                                                                    • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00433B20
                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00433B27
                                                                                                    • GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00433B33
                                                                                                    • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00433B44
                                                                                                    • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00433B4C
                                                                                                    • AttachThreadInput.USER32(00000000,?,00000001), ref: 00433B54
                                                                                                    • SetForegroundWindow.USER32(000000FF), ref: 00433B57
                                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00433B6C
                                                                                                    • keybd_event.USER32(00000012,00000000), ref: 00433B77
                                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00433B81
                                                                                                    • keybd_event.USER32(00000012,00000000), ref: 00433B86
                                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00433B8F
                                                                                                    • keybd_event.USER32(00000012,00000000), ref: 00433B94
                                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 00433B9E
                                                                                                    • keybd_event.USER32(00000012,00000000), ref: 00433BA3
                                                                                                    • SetForegroundWindow.USER32(000000FF), ref: 00433BA6
                                                                                                    • AttachThreadInput.USER32(000000FF,?,00000000), ref: 00433BCD
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                    • String ID: Shell_TrayWnd
                                                                                                    • API String ID: 4125248594-2988720461
                                                                                                    • Opcode ID: 79a538e32b3f125d6a561ae78cd43835b50fe1cc392c4c75e7dbb357814694f3
                                                                                                    • Instruction ID: 54c4a4d9e579f93b80265a71860c2228dc5bbbd44496be3aa91a2de113801f75
                                                                                                    • Opcode Fuzzy Hash: 79a538e32b3f125d6a561ae78cd43835b50fe1cc392c4c75e7dbb357814694f3
                                                                                                    • Instruction Fuzzy Hash: 2831C975F403187BEB206F759C4AF7F7E6CEB45B50F104026FA05EA1D1DAB46D00AAA8
                                                                                                    Function 003FACC5 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 223COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003FB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003FB180
                                                                                                      • Part of subcall function 003FB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003FB1AD
                                                                                                      • Part of subcall function 003FB134: GetLastError.KERNEL32 ref: 003FB1BA
                                                                                                    • _memset.LIBCMT ref: 003FAD08
                                                                                                    • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 003FAD5A
                                                                                                    • CloseHandle.KERNEL32(?), ref: 003FAD6B
                                                                                                    • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 003FAD82
                                                                                                    • GetProcessWindowStation.USER32 ref: 003FAD9B
                                                                                                    • SetProcessWindowStation.USER32(00000000), ref: 003FADA5
                                                                                                    • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 003FADBF
                                                                                                      • Part of subcall function 003FAB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,003FACC0), ref: 003FAB99
                                                                                                      • Part of subcall function 003FAB84: CloseHandle.KERNEL32(?,?,003FACC0), ref: 003FABAB
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                                                                    • String ID: $H*G$default$winsta0
                                                                                                    • API String ID: 2063423040-773203427
                                                                                                    • Opcode ID: da74369a401773ad7e71f158ecf7760e7d1089164d2534ce61938cdb1c2b068f
                                                                                                    • Instruction ID: 8169a88bcb30a4a0be0473181de7ca500155ae2fd50862f1223ba73e9727c11b
                                                                                                    • Opcode Fuzzy Hash: da74369a401773ad7e71f158ecf7760e7d1089164d2534ce61938cdb1c2b068f
                                                                                                    • Instruction Fuzzy Hash: 41819DB190060DAFDF12DFA4CC45AFEBBB8EF14344F054129FA18A6161D7718E54DB61
                                                                                                    Function 004060DD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174filestringCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 00406EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00405FA6,?), ref: 00406ED8
                                                                                                      • Part of subcall function 00406EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00405FA6,?), ref: 00406EF1
                                                                                                      • Part of subcall function 0040725E: __wsplitpath.LIBCMT ref: 0040727B
                                                                                                      • Part of subcall function 0040725E: __wsplitpath.LIBCMT ref: 0040728E
                                                                                                      • Part of subcall function 004072CB: GetFileAttributesW.KERNEL32(?,00406019), ref: 004072CC
                                                                                                    • _wcscat.LIBCMT ref: 00406149
                                                                                                    • _wcscat.LIBCMT ref: 00406167
                                                                                                    • __wsplitpath.LIBCMT ref: 0040618E
                                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 004061A4
                                                                                                    • _wcscpy.LIBCMT ref: 00406209
                                                                                                    • _wcscat.LIBCMT ref: 0040621C
                                                                                                    • _wcscat.LIBCMT ref: 0040622F
                                                                                                    • lstrcmpiW.KERNEL32(?,?), ref: 0040625D
                                                                                                    • DeleteFileW.KERNEL32(?), ref: 0040626E
                                                                                                    • MoveFileW.KERNEL32(?,?), ref: 00406289
                                                                                                    • MoveFileW.KERNEL32(?,?), ref: 00406298
                                                                                                    • CopyFileW.KERNEL32(?,?,00000000), ref: 004062AD
                                                                                                    • DeleteFileW.KERNEL32(?), ref: 004062BE
                                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 004062E1
                                                                                                    • FindClose.KERNEL32(00000000), ref: 004062FD
                                                                                                    • FindClose.KERNEL32(00000000), ref: 0040630B
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
                                                                                                    • String ID: \*.*
                                                                                                    • API String ID: 1917200108-1173974218
                                                                                                    • Opcode ID: aed879cf5f4542d99b00ce2fd60ac2d9db047052836b4b42e9ea828e16bd0bd0
                                                                                                    • Instruction ID: 1469a4957f6b5280f5eee8ad57cf3ff7752dd41eba8986efb57ae2959c8cbefc
                                                                                                    • Opcode Fuzzy Hash: aed879cf5f4542d99b00ce2fd60ac2d9db047052836b4b42e9ea828e16bd0bd0
                                                                                                    • Instruction Fuzzy Hash: E2512072C0811C6ACB21EB91CC45DEB77BCAF05300F0601FAE546F6181DE7A97998FA9
                                                                                                    Function 00416B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • OpenClipboard.USER32(0045DC00), ref: 00416B36
                                                                                                    • IsClipboardFormatAvailable.USER32(0000000D), ref: 00416B44
                                                                                                    • GetClipboardData.USER32(0000000D), ref: 00416B4C
                                                                                                    • CloseClipboard.USER32 ref: 00416B58
                                                                                                    • GlobalLock.KERNEL32(00000000), ref: 00416B74
                                                                                                    • CloseClipboard.USER32 ref: 00416B7E
                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00416B93
                                                                                                    • IsClipboardFormatAvailable.USER32(00000001), ref: 00416BA0
                                                                                                    • GetClipboardData.USER32(00000001), ref: 00416BA8
                                                                                                    • GlobalLock.KERNEL32(00000000), ref: 00416BB5
                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00416BE9
                                                                                                    • CloseClipboard.USER32 ref: 00416CF6
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                                                                    • String ID:
                                                                                                    • API String ID: 3222323430-0
                                                                                                    • Opcode ID: 85b15f125e24e7aa020e9c64afd3b550f7ae4911ce03ae45b9b0da4c5bd8bfc4
                                                                                                    • Instruction ID: 76079e3173beda2891e5a883df87912e65452cd1719f9f902bef9d5964bbedd0
                                                                                                    • Opcode Fuzzy Hash: 85b15f125e24e7aa020e9c64afd3b550f7ae4911ce03ae45b9b0da4c5bd8bfc4
                                                                                                    • Instruction Fuzzy Hash: B651B175604201ABD301EF64DC86FAF77A8AF45B00F02042EF55AD62D1EF74EC458B6A
                                                                                                    Function 0040F5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0040F62B
                                                                                                    • FindClose.KERNEL32(00000000), ref: 0040F67F
                                                                                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0040F6A4
                                                                                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0040F6BB
                                                                                                    • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040F6E2
                                                                                                    • __swprintf.LIBCMT ref: 0040F72E
                                                                                                    • __swprintf.LIBCMT ref: 0040F767
                                                                                                    • __swprintf.LIBCMT ref: 0040F7BB
                                                                                                      • Part of subcall function 003E172B: __woutput_l.LIBCMT ref: 003E1784
                                                                                                    • __swprintf.LIBCMT ref: 0040F809
                                                                                                    • __swprintf.LIBCMT ref: 0040F858
                                                                                                    • __swprintf.LIBCMT ref: 0040F8A7
                                                                                                    • __swprintf.LIBCMT ref: 0040F8F6
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
                                                                                                    • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                                                                    • API String ID: 835046349-2428617273
                                                                                                    • Opcode ID: 9c9b2423f68fe64b90ddf24437417cce945c725f41c095223d30a69ca84c5fbf
                                                                                                    • Instruction ID: 56aeb5767fa5ce41daf606470068395557b667636e09fdfa5d9f521841558d37
                                                                                                    • Opcode Fuzzy Hash: 9c9b2423f68fe64b90ddf24437417cce945c725f41c095223d30a69ca84c5fbf
                                                                                                    • Instruction Fuzzy Hash: 4AA10EB2418344ABC311EBA5C885EAFB7ECBF98704F44092EF595C7192EB34D949C762
                                                                                                    Function 00411B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00411B50
                                                                                                    • _wcscmp.LIBCMT ref: 00411B65
                                                                                                    • _wcscmp.LIBCMT ref: 00411B7C
                                                                                                    • GetFileAttributesW.KERNEL32(?), ref: 00411B8E
                                                                                                    • SetFileAttributesW.KERNEL32(?,?), ref: 00411BA8
                                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 00411BC0
                                                                                                    • FindClose.KERNEL32(00000000), ref: 00411BCB
                                                                                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 00411BE7
                                                                                                    • _wcscmp.LIBCMT ref: 00411C0E
                                                                                                    • _wcscmp.LIBCMT ref: 00411C25
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00411C37
                                                                                                    • SetCurrentDirectoryW.KERNEL32(004739FC), ref: 00411C55
                                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 00411C5F
                                                                                                    • FindClose.KERNEL32(00000000), ref: 00411C6C
                                                                                                    • FindClose.KERNEL32(00000000), ref: 00411C7C
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                                                                    • String ID: *.*
                                                                                                    • API String ID: 1803514871-438819550
                                                                                                    • Opcode ID: 627bc9a0bf9dda558150f41526b8dc4a4d44439b74d66b8d0ef1287d7f996d19
                                                                                                    • Instruction ID: 9441cf6894b6903162bb5695d2f3bc3089ac78e39c2d4700f50ef2ebc9094870
                                                                                                    • Opcode Fuzzy Hash: 627bc9a0bf9dda558150f41526b8dc4a4d44439b74d66b8d0ef1287d7f996d19
                                                                                                    • Instruction Fuzzy Hash: 3E31D675A002196BDF249FA0DC49ADF77AC9F06310F1041A7FA15D21A0EB78DA858A6C
                                                                                                    Function 00411C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00411CAB
                                                                                                    • _wcscmp.LIBCMT ref: 00411CC0
                                                                                                    • _wcscmp.LIBCMT ref: 00411CD7
                                                                                                      • Part of subcall function 00406BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00406BEF
                                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 00411D06
                                                                                                    • FindClose.KERNEL32(00000000), ref: 00411D11
                                                                                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 00411D2D
                                                                                                    • _wcscmp.LIBCMT ref: 00411D54
                                                                                                    • _wcscmp.LIBCMT ref: 00411D6B
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00411D7D
                                                                                                    • SetCurrentDirectoryW.KERNEL32(004739FC), ref: 00411D9B
                                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 00411DA5
                                                                                                    • FindClose.KERNEL32(00000000), ref: 00411DB2
                                                                                                    • FindClose.KERNEL32(00000000), ref: 00411DC2
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                                                                    • String ID: *.*
                                                                                                    • API String ID: 1824444939-438819550
                                                                                                    • Opcode ID: 890bc2f53ace8c71a5bdd8af7cb858db6f05d6ce1d5992f1be542fa3432dabf2
                                                                                                    • Instruction ID: c41329fc895cc0935d0fd489f027b8ec1835c1fde6e6160d13930b7872720ee8
                                                                                                    • Opcode Fuzzy Hash: 890bc2f53ace8c71a5bdd8af7cb858db6f05d6ce1d5992f1be542fa3432dabf2
                                                                                                    • Instruction Fuzzy Hash: D3310A7190061A6ADF11EFA0EC09BDF77AC9F46324F104567FA01A31E0DB78DE858A5C
                                                                                                    Function 003C7D19 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 962COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _memset
                                                                                                    • String ID: Q\E$[$[:<:]]$[:>:]]$\$\$\$\b(?<=\w)$\b(?=\w)$]$^
                                                                                                    • API String ID: 2102423945-2023335898
                                                                                                    • Opcode ID: 09c4a06cbc3aad2a26601ccf9d5ae8037825215346c4168cfb3845270b9f196c
                                                                                                    • Instruction ID: c33c9d15a81575d731bc18199ff4613711ec5ee08f1354b6d012cddb5f43c7a3
                                                                                                    • Opcode Fuzzy Hash: 09c4a06cbc3aad2a26601ccf9d5ae8037825215346c4168cfb3845270b9f196c
                                                                                                    • Instruction Fuzzy Hash: D782C271D04219CBCB25CF98C881BEEB7B1BF48310F25816AD859AB351E774AE85CF94
                                                                                                    Function 0041091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetLocalTime.KERNEL32(?), ref: 004109DF
                                                                                                    • SystemTimeToFileTime.KERNEL32(?,?), ref: 004109EF
                                                                                                    • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 004109FB
                                                                                                    • __wsplitpath.LIBCMT ref: 00410A59
                                                                                                    • _wcscat.LIBCMT ref: 00410A71
                                                                                                    • _wcscat.LIBCMT ref: 00410A83
                                                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00410A98
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00410AAC
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00410ADE
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00410AFF
                                                                                                    • _wcscpy.LIBCMT ref: 00410B0B
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00410B4A
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
                                                                                                    • String ID: *.*
                                                                                                    • API String ID: 3566783562-438819550
                                                                                                    • Opcode ID: 0eac9bb6451bb6a68bd88db088051252bdb2b9675b3f3b35bb8638acae2a5761
                                                                                                    • Instruction ID: a55048a608ef784a0e0344b927274720573d8db0fef398554a6a045e2647b0ff
                                                                                                    • Opcode Fuzzy Hash: 0eac9bb6451bb6a68bd88db088051252bdb2b9675b3f3b35bb8638acae2a5761
                                                                                                    • Instruction Fuzzy Hash: 316156B25082059FC710EF60C845AAFB3E8FF89310F04492EF989D7251DB75EA85CB96
                                                                                                    Function 003FA66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003FABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 003FABD7
                                                                                                      • Part of subcall function 003FABBB: GetLastError.KERNEL32(?,003FA69F,?,?,?), ref: 003FABE1
                                                                                                      • Part of subcall function 003FABBB: GetProcessHeap.KERNEL32(00000008,?,?,003FA69F,?,?,?), ref: 003FABF0
                                                                                                      • Part of subcall function 003FABBB: HeapAlloc.KERNEL32(00000000,?,003FA69F,?,?,?), ref: 003FABF7
                                                                                                      • Part of subcall function 003FABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 003FAC0E
                                                                                                      • Part of subcall function 003FAC56: GetProcessHeap.KERNEL32(00000008,003FA6B5,00000000,00000000,?,003FA6B5,?), ref: 003FAC62
                                                                                                      • Part of subcall function 003FAC56: HeapAlloc.KERNEL32(00000000,?,003FA6B5,?), ref: 003FAC69
                                                                                                      • Part of subcall function 003FAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,003FA6B5,?), ref: 003FAC7A
                                                                                                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 003FA6D0
                                                                                                    • _memset.LIBCMT ref: 003FA6E5
                                                                                                    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 003FA704
                                                                                                    • GetLengthSid.ADVAPI32(?), ref: 003FA715
                                                                                                    • GetAce.ADVAPI32(?,00000000,?), ref: 003FA752
                                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003FA76E
                                                                                                    • GetLengthSid.ADVAPI32(?), ref: 003FA78B
                                                                                                    • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 003FA79A
                                                                                                    • HeapAlloc.KERNEL32(00000000), ref: 003FA7A1
                                                                                                    • GetLengthSid.ADVAPI32(?,00000008,?), ref: 003FA7C2
                                                                                                    • CopySid.ADVAPI32(00000000), ref: 003FA7C9
                                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 003FA7FA
                                                                                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 003FA820
                                                                                                    • SetUserObjectSecurity.USER32(?,00000004,?), ref: 003FA834
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 3996160137-0
                                                                                                    • Opcode ID: 999f3f2ec7237ab73e82f2a546d3e5d0ec88f233e891de7a0b97bbcc5df3db82
                                                                                                    • Instruction ID: c3053d749b601e91bd0e5564585515e17a93cbbff4ac1a8176a5d916e4ad4ada
                                                                                                    • Opcode Fuzzy Hash: 999f3f2ec7237ab73e82f2a546d3e5d0ec88f233e891de7a0b97bbcc5df3db82
                                                                                                    • Instruction Fuzzy Hash: 39514BB5900609ABDF12DFA5DC44EFEBBB9FF05304F048129FA15AB290DB749A05CB61
                                                                                                    Function 003C6F07 Relevance: 20.9, Strings: 16, Instructions: 883COMMON
                                                                                                    Download Yara Rule
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID: F$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$FFF F
                                                                                                    • API String ID: 0-3812537758
                                                                                                    • Opcode ID: 4e2981c496e713727923edb8825d77219b3c77147dfc78e886e3e267b8d404c2
                                                                                                    • Instruction ID: 4642cbc2eba25c98c5afb427d72ac30900de392388a20597c1f1b33fa79975a3
                                                                                                    • Opcode Fuzzy Hash: 4e2981c496e713727923edb8825d77219b3c77147dfc78e886e3e267b8d404c2
                                                                                                    • Instruction Fuzzy Hash: B0728071E04219DBDB25CF59C881BAEB7B5BF48310F64816BE805EB280EB749E41DF94
                                                                                                    Function 004063F9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 00406EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00405FA6,?), ref: 00406ED8
                                                                                                      • Part of subcall function 004072CB: GetFileAttributesW.KERNEL32(?,00406019), ref: 004072CC
                                                                                                    • _wcscat.LIBCMT ref: 00406441
                                                                                                    • __wsplitpath.LIBCMT ref: 0040645F
                                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 00406474
                                                                                                    • _wcscpy.LIBCMT ref: 004064A3
                                                                                                    • _wcscat.LIBCMT ref: 004064B8
                                                                                                    • _wcscat.LIBCMT ref: 004064CA
                                                                                                    • DeleteFileW.KERNEL32(?), ref: 004064DA
                                                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 004064EB
                                                                                                    • FindClose.KERNEL32(00000000), ref: 00406506
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
                                                                                                    • String ID: \*.*
                                                                                                    • API String ID: 2643075503-1173974218
                                                                                                    • Opcode ID: d6ea630ddb26953570da9987fa6a05781667d718e283df6da5f1f57f3257ffc6
                                                                                                    • Instruction ID: d8261a63c2c782d8f863109fb8776778225528ea18639bc21ac8b5113da97f58
                                                                                                    • Opcode Fuzzy Hash: d6ea630ddb26953570da9987fa6a05781667d718e283df6da5f1f57f3257ffc6
                                                                                                    • Instruction Fuzzy Hash: A231A2B2408384AAC321DBA48C859DB77DCAF56304F400A2FF6D9C3181EA35D54987AB
                                                                                                    Function 004231BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 00423C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00422BB5,?,?), ref: 00423C1D
                                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0042328E
                                                                                                      • Part of subcall function 003C936C: __swprintf.LIBCMT ref: 003C93AB
                                                                                                      • Part of subcall function 003C936C: __itow.LIBCMT ref: 003C93DF
                                                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0042332D
                                                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 004233C5
                                                                                                    • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00423604
                                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 00423611
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                                                                    • String ID:
                                                                                                    • API String ID: 1240663315-0
                                                                                                    • Opcode ID: 722932300c4a8309f968e909ab9a1a3aa35e8143d66b1388430b803969071ed6
                                                                                                    • Instruction ID: 47574f5610cebe424399385dcf9da38242cc1e6c6cc3bffd40dd14f7f084ce24
                                                                                                    • Opcode Fuzzy Hash: 722932300c4a8309f968e909ab9a1a3aa35e8143d66b1388430b803969071ed6
                                                                                                    • Instruction Fuzzy Hash: CBE16E35604210AFCB15DF29D895E2BBBF8EF89314B04856EF44ADB2A1CB34ED05CB56
                                                                                                    Function 00402B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetKeyboardState.USER32(?), ref: 00402B5F
                                                                                                    • GetAsyncKeyState.USER32(000000A0), ref: 00402BE0
                                                                                                    • GetKeyState.USER32(000000A0), ref: 00402BFB
                                                                                                    • GetAsyncKeyState.USER32(000000A1), ref: 00402C15
                                                                                                    • GetKeyState.USER32(000000A1), ref: 00402C2A
                                                                                                    • GetAsyncKeyState.USER32(00000011), ref: 00402C42
                                                                                                    • GetKeyState.USER32(00000011), ref: 00402C54
                                                                                                    • GetAsyncKeyState.USER32(00000012), ref: 00402C6C
                                                                                                    • GetKeyState.USER32(00000012), ref: 00402C7E
                                                                                                    • GetAsyncKeyState.USER32(0000005B), ref: 00402C96
                                                                                                    • GetKeyState.USER32(0000005B), ref: 00402CA8
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: State$Async$Keyboard
                                                                                                    • String ID:
                                                                                                    • API String ID: 541375521-0
                                                                                                    • Opcode ID: 7f7ff1406a0c47da1f39d706a95d53a1d2e9dacc1817b238fc8851d1f590931f
                                                                                                    • Instruction ID: 292f4e1383865806f0de9bea0ab9a8ac7eff7d45c7b8a3692d9f0fc99e6aa499
                                                                                                    • Opcode Fuzzy Hash: 7f7ff1406a0c47da1f39d706a95d53a1d2e9dacc1817b238fc8851d1f590931f
                                                                                                    • Instruction Fuzzy Hash: E34179349087C969FF355B648A0C3ABBEA06B11344F04807BD5C6667C1DBFC99C4C76A
                                                                                                    Function 00416D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                                                    • String ID:
                                                                                                    • API String ID: 1737998785-0
                                                                                                    • Opcode ID: 070d19f5f16673edda499913d57a80e9d9960157d393f4eb74652124a50b9fc0
                                                                                                    • Instruction ID: 61e81ea3716988fd4092390c454334c729d212acaab48ee90c4721e8dfc8a79a
                                                                                                    • Opcode Fuzzy Hash: 070d19f5f16673edda499913d57a80e9d9960157d393f4eb74652124a50b9fc0
                                                                                                    • Instruction Fuzzy Hash: F921AE35700110AFDB01AF64EC49B6E77A8FF45710F02842AF90ADB3A1CB78ED418B59
                                                                                                    Function 0041C18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003F9ABF: CLSIDFromProgID.OLE32 ref: 003F9ADC
                                                                                                      • Part of subcall function 003F9ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 003F9AF7
                                                                                                      • Part of subcall function 003F9ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 003F9B05
                                                                                                      • Part of subcall function 003F9ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 003F9B15
                                                                                                    • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 0041C235
                                                                                                    • _memset.LIBCMT ref: 0041C242
                                                                                                    • _memset.LIBCMT ref: 0041C360
                                                                                                    • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 0041C38C
                                                                                                    • CoTaskMemFree.OLE32(?), ref: 0041C397
                                                                                                    Strings
                                                                                                    • NULL Pointer assignment, xrefs: 0041C3E5
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                                                                    • String ID: NULL Pointer assignment
                                                                                                    • API String ID: 1300414916-2785691316
                                                                                                    • Opcode ID: 421382acb71401bda4b9d878807b44eed9f180994b02bc23e372a9c9f1e1a165
                                                                                                    • Instruction ID: 71d48fd9013be7bda503d843213be67a19afc7ce59f986804a60f75e8417c85f
                                                                                                    • Opcode Fuzzy Hash: 421382acb71401bda4b9d878807b44eed9f180994b02bc23e372a9c9f1e1a165
                                                                                                    • Instruction Fuzzy Hash: 3F914D71D00228ABDB11DFD5DC91EEEBBB9EF04310F10816AF919AB281DB745A45CFA4
                                                                                                    Function 004079D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003FB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003FB180
                                                                                                      • Part of subcall function 003FB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003FB1AD
                                                                                                      • Part of subcall function 003FB134: GetLastError.KERNEL32 ref: 003FB1BA
                                                                                                    • ExitWindowsEx.USER32(?,00000000), ref: 00407A0F
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                                                    • String ID: $@$SeShutdownPrivilege
                                                                                                    • API String ID: 2234035333-194228
                                                                                                    • Opcode ID: 6d1dbe13e0194ba242cdf3f64a32f47bdd2f5cdc420a8ba31b4ba1f29546057f
                                                                                                    • Instruction ID: 651bee876bcc3efdf28cbbe436e72c5b13d394f87444eeddd8717bbf72d2cfd4
                                                                                                    • Opcode Fuzzy Hash: 6d1dbe13e0194ba242cdf3f64a32f47bdd2f5cdc420a8ba31b4ba1f29546057f
                                                                                                    • Instruction Fuzzy Hash: 4301D871F582116AF7285764DC5ABBF72589701341F244836B943B21C1D57C6E0185BF
                                                                                                    Function 00418C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00418CA8
                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00418CB7
                                                                                                    • bind.WSOCK32(00000000,?,00000010), ref: 00418CD3
                                                                                                    • listen.WSOCK32(00000000,00000005), ref: 00418CE2
                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00418CFC
                                                                                                    • closesocket.WSOCK32(00000000,00000000), ref: 00418D10
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorLast$bindclosesocketlistensocket
                                                                                                    • String ID:
                                                                                                    • API String ID: 1279440585-0
                                                                                                    • Opcode ID: d0d5a2c31805345ea13991437881ba6ceec4a88006664b99dd40315676a6d293
                                                                                                    • Instruction ID: d50a16afc8728dd46f34fb43f57cd0a3c145c73611452003fef87746a906eb5b
                                                                                                    • Opcode Fuzzy Hash: d0d5a2c31805345ea13991437881ba6ceec4a88006664b99dd40315676a6d293
                                                                                                    • Instruction Fuzzy Hash: 2921E1356002009FCB10EF68DC85BAEB7A9EF49314F10816EF917AB3D2CB34AD418B55
                                                                                                    Function 00406532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00406554
                                                                                                    • Process32FirstW.KERNEL32(00000000,0000022C), ref: 00406564
                                                                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 00406583
                                                                                                    • __wsplitpath.LIBCMT ref: 004065A7
                                                                                                    • _wcscat.LIBCMT ref: 004065BA
                                                                                                    • CloseHandle.KERNEL32(00000000,?,00000000), ref: 004065F9
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
                                                                                                    • String ID:
                                                                                                    • API String ID: 1605983538-0
                                                                                                    • Opcode ID: 5fc66d99d8308a0e1c64e39264cacf6b0d6d3c37226a0b7458658cf7f02c8049
                                                                                                    • Instruction ID: 7396d6311e1af9be5e6258b7e12b29bd4a1e38fd1def1d4556d69d1644a604da
                                                                                                    • Opcode Fuzzy Hash: 5fc66d99d8308a0e1c64e39264cacf6b0d6d3c37226a0b7458658cf7f02c8049
                                                                                                    • Instruction Fuzzy Hash: C1219871900258BBDB11AFA4DC88FDEB7BCAB45300F5000BAE505E7181DB759F85CB55
                                                                                                    Function 003C9B60 Relevance: 8.6, Strings: 6, Instructions: 1055COMMON
                                                                                                    Download Yara Rule
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID: ERCP$VUUU$VUUU$VUUU$VUUU$F
                                                                                                    • API String ID: 0-7147324
                                                                                                    • Opcode ID: e6e1a32f95e05082810d83d15974104cd2c93265e3a2fb58ce6469e2b295a1ee
                                                                                                    • Instruction ID: 75ac27bde3ae299b1d83480e7db9d3ef7e05528cf082877cf7c6adfb961519d0
                                                                                                    • Opcode Fuzzy Hash: e6e1a32f95e05082810d83d15974104cd2c93265e3a2fb58ce6469e2b295a1ee
                                                                                                    • Instruction Fuzzy Hash: DE928C71E00629CBEF25CF58C884BAEB7B1BB54314F1981AED816EB380D7749D81CB95
                                                                                                    Function 004013CA Relevance: 8.1, APIs: 1, Strings: 4, Instructions: 560stringCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • lstrlenW.KERNEL32(?,?,?,00000000), ref: 004013DC
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: lstrlen
                                                                                                    • String ID: ($,2G$<2G$|
                                                                                                    • API String ID: 1659193697-1286567917
                                                                                                    • Opcode ID: 35612da798a9345d3a8a4a01cffaaeb18de0de2c10a6674510a164cae7ef7d3f
                                                                                                    • Instruction ID: aa91a0e1ede455d02239546ba78932d96c4d3d7c4d459cf095f32ce86ab51e64
                                                                                                    • Opcode Fuzzy Hash: 35612da798a9345d3a8a4a01cffaaeb18de0de2c10a6674510a164cae7ef7d3f
                                                                                                    • Instruction Fuzzy Hash: 2A322575A007059FC728DF69C480A6AB7F0FF48320B15C56EE59AEB3A2E774E941CB44
                                                                                                    Function 0041923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 0041A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 0041A84E
                                                                                                    • socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 00419296
                                                                                                    • WSAGetLastError.WSOCK32(00000000,00000000), ref: 004192B9
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorLastinet_addrsocket
                                                                                                    • String ID:
                                                                                                    • API String ID: 4170576061-0
                                                                                                    • Opcode ID: a3716916320bfbfb4c5c17f71486ddedef93e96df5da914b3cfa242038856003
                                                                                                    • Instruction ID: ef09f51573f7e7d04c1ff036768c4a0540c3bae4e47426f96db1a0c20291a301
                                                                                                    • Opcode Fuzzy Hash: a3716916320bfbfb4c5c17f71486ddedef93e96df5da914b3cfa242038856003
                                                                                                    • Instruction Fuzzy Hash: FF41F175600200AFDB15AB68C882F7E77EDEF44324F00445EF956AB3D2CB749E018B95
                                                                                                    Function 0040EB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0040EB8A
                                                                                                    • _wcscmp.LIBCMT ref: 0040EBBA
                                                                                                    • _wcscmp.LIBCMT ref: 0040EBCF
                                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0040EBE0
                                                                                                    • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0040EC0E
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Find$File_wcscmp$CloseFirstNext
                                                                                                    • String ID:
                                                                                                    • API String ID: 2387731787-0
                                                                                                    • Opcode ID: 69dc643c72631aa44fb463eae6c54f515d20f8ee1c08b13a7083335e3e24af24
                                                                                                    • Instruction ID: 9a053a9f79912c0592ccd2cb738417302396378bcdcda219dcf5faef47d86a82
                                                                                                    • Opcode Fuzzy Hash: 69dc643c72631aa44fb463eae6c54f515d20f8ee1c08b13a7083335e3e24af24
                                                                                                    • Instruction Fuzzy Hash: F641FF756042028FD708DF29C490A9AB3E4FF4A324F10496EEA5A8B3E1DB36E940CB55
                                                                                                    Function 00428111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                    • String ID:
                                                                                                    • API String ID: 292994002-0
                                                                                                    • Opcode ID: 3cbb79d85a69c8e46138c3717a2b6277ffab2e3de29253a03fe9ec769a4de582
                                                                                                    • Instruction ID: 568f2e4e7c455d6b8902bf7aa31be4065ec2d227e07b6ba6162bb0815fc8f4dd
                                                                                                    • Opcode Fuzzy Hash: 3cbb79d85a69c8e46138c3717a2b6277ffab2e3de29253a03fe9ec769a4de582
                                                                                                    • Instruction Fuzzy Hash: F811DD317022206FE7216F26AC44F3FBB98EF55760B44042EF849D7281CF38AD1386A9
                                                                                                    Function 003DE01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,003DE014,771B0AE0,003DDEF1,0045DC38,?,?), ref: 003DE02C
                                                                                                    • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 003DE03E
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                    • String ID: GetNativeSystemInfo$kernel32.dll
                                                                                                    • API String ID: 2574300362-192647395
                                                                                                    • Opcode ID: 62e30b13399e5d45d5d1e80517b4c0e70b87f7d775cca168ce51a40c357e020a
                                                                                                    • Instruction ID: 187c8e08564e0fc0f0f494622b372c72634d135d447471d7c5c7441df271d0d0
                                                                                                    • Opcode Fuzzy Hash: 62e30b13399e5d45d5d1e80517b4c0e70b87f7d775cca168ce51a40c357e020a
                                                                                                    • Instruction Fuzzy Hash: 48D0A736900B129FC7325F71FD087527AD4AB01300F29843BE885D2250D7F8C880C764
                                                                                                    Function 003DB11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DB34E: GetWindowLongW.USER32(?,000000EB), ref: 003DB35F
                                                                                                    • DefDlgProcW.USER32(?,?,?,?,?), ref: 003DB22F
                                                                                                      • Part of subcall function 003DB55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 003DB5A5
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Proc$LongWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 2749884682-0
                                                                                                    • Opcode ID: 779d64ea3ec3fac3793d6574f85d3224ab1718ce8be9bd07e79852f79f83b287
                                                                                                    • Instruction ID: 05bde1a0faf5a3fbf6069b3cbedb7ab729394c6dea980dffc9196b2d42cff607
                                                                                                    • Opcode Fuzzy Hash: 779d64ea3ec3fac3793d6574f85d3224ab1718ce8be9bd07e79852f79f83b287
                                                                                                    • Instruction Fuzzy Hash: 20A18B73105004FADB2A6B6B7C88E7FA96CEB6A344F52092FF441D67D1DB189C01927A
                                                                                                    Function 00414EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,004143BF,00000000), ref: 00414FA6
                                                                                                    • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00414FD2
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Internet$AvailableDataFileQueryRead
                                                                                                    • String ID:
                                                                                                    • API String ID: 599397726-0
                                                                                                    • Opcode ID: 7dff2ffa290ca473fa976d3bb9013882511eb0a360a981b29f0fbd2b804be312
                                                                                                    • Instruction ID: 043b4266579139d283c3641cf29cb8c6d9fbd808712ac0875a7de063affc697a
                                                                                                    • Opcode Fuzzy Hash: 7dff2ffa290ca473fa976d3bb9013882511eb0a360a981b29f0fbd2b804be312
                                                                                                    • Instruction Fuzzy Hash: 2F41D871504209FFEB21DF85DC85EFB77BCEB80768F10402FF60566280DA759E8296A8
                                                                                                    Function 003C77B0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1076COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _memmove
                                                                                                    • String ID: \QG
                                                                                                    • API String ID: 4104443479-3523196640
                                                                                                    • Opcode ID: 21e60db4de436735714acc92a7a4691c6ab6575e51710840885e51201fd8de1c
                                                                                                    • Instruction ID: 04697bdb5a1fcf8e0f85ea62af5ca279b29b01cd9380e60526c5a786804741ca
                                                                                                    • Opcode Fuzzy Hash: 21e60db4de436735714acc92a7a4691c6ab6575e51710840885e51201fd8de1c
                                                                                                    • Instruction Fuzzy Hash: 8CA25974E04219CFDB25CF58C480BADBBB1BF48314F2581AAE859AB391D7749E81CF94
                                                                                                    Function 0040E1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0040E20D
                                                                                                    • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0040E267
                                                                                                    • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0040E2B4
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorMode$DiskFreeSpace
                                                                                                    • String ID:
                                                                                                    • API String ID: 1682464887-0
                                                                                                    • Opcode ID: 107999bea8e1ae84db6a7bc8e2a45ea1db71b47ce64ac3ec8e34d610dc77aa13
                                                                                                    • Instruction ID: f211b6cb4fce03e643099c599649233ba7ad0729bd9c0057c3b981d6bc20790b
                                                                                                    • Opcode Fuzzy Hash: 107999bea8e1ae84db6a7bc8e2a45ea1db71b47ce64ac3ec8e34d610dc77aa13
                                                                                                    • Instruction Fuzzy Hash: 24215C75A10118EFCB00EFA5D884EAEBBB8FF49314F0484AAE905EB391DB359915CB54
                                                                                                    Function 003FB134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DF4EA: std::exception::exception.LIBCMT ref: 003DF51E
                                                                                                      • Part of subcall function 003DF4EA: __CxxThrowException@8.LIBCMT ref: 003DF533
                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003FB180
                                                                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003FB1AD
                                                                                                    • GetLastError.KERNEL32 ref: 003FB1BA
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                                                                    • String ID:
                                                                                                    • API String ID: 1922334811-0
                                                                                                    • Opcode ID: bcf69119582cc8df5020dee2c82396fb1b989f127dede3b0eb99997097201150
                                                                                                    • Instruction ID: de274353dbd98ec16f7eb71407e4c171e4b5ad6d518128bc9d6b46f4e77f4fd1
                                                                                                    • Opcode Fuzzy Hash: bcf69119582cc8df5020dee2c82396fb1b989f127dede3b0eb99997097201150
                                                                                                    • Instruction Fuzzy Hash: 7311CEB2900204AFE728AF64ECC6D2BB7BDFB44314B20852EE45697240DB70FC418A60
                                                                                                    Function 00406606 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00406623
                                                                                                    • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00406664
                                                                                                    • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0040666F
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CloseControlCreateDeviceFileHandle
                                                                                                    • String ID:
                                                                                                    • API String ID: 33631002-0
                                                                                                    • Opcode ID: b4363ec5f7fdc01c6bdfc0ebc6eb1218d4f4e7c43ae29e714aa33fa5100aef96
                                                                                                    • Instruction ID: 88b5e3e4b5f93b319a29446ed294fbd8a723ae44acbe9e4d22ea0b20ac551774
                                                                                                    • Opcode Fuzzy Hash: b4363ec5f7fdc01c6bdfc0ebc6eb1218d4f4e7c43ae29e714aa33fa5100aef96
                                                                                                    • Instruction Fuzzy Hash: B4115EB5E01228BFDB108FA8DC44BAFBBBCEB45B10F104562F900F6290D7B15A058BA5
                                                                                                    Function 004071FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00407223
                                                                                                    • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0040723A
                                                                                                    • FreeSid.ADVAPI32(?), ref: 0040724A
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                                    • String ID:
                                                                                                    • API String ID: 3429775523-0
                                                                                                    • Opcode ID: 65ed7e1f32bf1d597f586d310bec1fbf159634af7332553f31f6ce36df68a88f
                                                                                                    • Instruction ID: 364470dd2eefd69c9611addcb8fd918a307cca5ea15214bfdc18ba2aefb53cb7
                                                                                                    • Opcode Fuzzy Hash: 65ed7e1f32bf1d597f586d310bec1fbf159634af7332553f31f6ce36df68a88f
                                                                                                    • Instruction Fuzzy Hash: 53F01D7AE04209BFDF04DFE4DD89AEEBBB8EF09205F104469A602E3191E2749A448B14
                                                                                                    Function 0040F56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0040F599
                                                                                                    • FindClose.KERNEL32(00000000), ref: 0040F5C9
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Find$CloseFileFirst
                                                                                                    • String ID:
                                                                                                    • API String ID: 2295610775-0
                                                                                                    • Opcode ID: 4a51f8614d4374a1db990ea495d445cddb58496224e5d3420b4117bc1dd5debc
                                                                                                    • Instruction ID: 9847ea1658f1da7b9243beba2ac1942f9463eb6721b5b63dafe375dee0fa4299
                                                                                                    • Opcode Fuzzy Hash: 4a51f8614d4374a1db990ea495d445cddb58496224e5d3420b4117bc1dd5debc
                                                                                                    • Instruction Fuzzy Hash: B611C4326102009FD714EF28D845A2EB3E8FF95324F00892EF8A5DB3D1DB34AD058B85
                                                                                                    Function 0040CE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0041BE6A,?,?,00000000,?), ref: 0040CEA7
                                                                                                    • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0041BE6A,?,?,00000000,?), ref: 0040CEB9
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorFormatLastMessage
                                                                                                    • String ID:
                                                                                                    • API String ID: 3479602957-0
                                                                                                    • Opcode ID: 8c59d40f95a66a204d38a481d43ae99964b8ea4f207ba12f319bfaeee0ae30c8
                                                                                                    • Instruction ID: 8e5a2ef49d6a4f816a19cbc203319b8898bc34fcc2fd33fcd9d2ef80259a7450
                                                                                                    • Opcode Fuzzy Hash: 8c59d40f95a66a204d38a481d43ae99964b8ea4f207ba12f319bfaeee0ae30c8
                                                                                                    • Instruction Fuzzy Hash: FCF08235500229EBDB109FA4DC89FEB776DBF09351F004266F919D6191D6709A40CBA5
                                                                                                    Function 0040411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00404153
                                                                                                    • keybd_event.USER32(?,75A4C0D0,?,00000000), ref: 00404166
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: InputSendkeybd_event
                                                                                                    • String ID:
                                                                                                    • API String ID: 3536248340-0
                                                                                                    • Opcode ID: 92039935ee7de1847cb242e693c2c51f05522e2ef5005936b28ac0939912ba06
                                                                                                    • Instruction ID: af9138adff924715ad8d74fbf78c83a18861ce193381e42f4ad1d41eee3b48ed
                                                                                                    • Opcode Fuzzy Hash: 92039935ee7de1847cb242e693c2c51f05522e2ef5005936b28ac0939912ba06
                                                                                                    • Instruction Fuzzy Hash: FAF0907490434DAFDB059FA0C809BBE7FB0EF00305F00801AF966AA191D779C612DFA4
                                                                                                    Function 003FAB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,003FACC0), ref: 003FAB99
                                                                                                    • CloseHandle.KERNEL32(?,?,003FACC0), ref: 003FABAB
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AdjustCloseHandlePrivilegesToken
                                                                                                    • String ID:
                                                                                                    • API String ID: 81990902-0
                                                                                                    • Opcode ID: 0bd8ce65db0b3faf7ca7ef3999f570e53358d92294db31e0fc8ab21231c6a73d
                                                                                                    • Instruction ID: 846efdeb6f9fcf5f454cb416b53920cc0c0222a173c47a8b9d66af15c36716c6
                                                                                                    • Opcode Fuzzy Hash: 0bd8ce65db0b3faf7ca7ef3999f570e53358d92294db31e0fc8ab21231c6a73d
                                                                                                    • Instruction Fuzzy Hash: B3E0E676000510AFE7262F54FC05D777BEAEF053207108439F95A85570DB626C90DB50
                                                                                                    Function 003E81AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,003E6DB3,-0000031A,?,?,00000001), ref: 003E81B1
                                                                                                    • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 003E81BA
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ExceptionFilterUnhandled
                                                                                                    • String ID:
                                                                                                    • API String ID: 3192549508-0
                                                                                                    • Opcode ID: b0fc98a2056181085b64910a3d1f699a4db16b5ab8d3096696c7cb6d0485756b
                                                                                                    • Instruction ID: de202a74e7011581bfff56f20b29af2f891278a1876da0e8dd1b65aa346b00d3
                                                                                                    • Opcode Fuzzy Hash: b0fc98a2056181085b64910a3d1f699a4db16b5ab8d3096696c7cb6d0485756b
                                                                                                    • Instruction Fuzzy Hash: 6EB09235544A08ABDB002FA1EC09B587FA8EB0AA52F008030FA0D440618B7254108AAA
                                                                                                    Function 003ED1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: 68a2aa27507458688e090ed022a6fce13e26b8886039bd0570df0eb02f9b5fbf
                                                                                                    • Instruction ID: 768cafc58ec87d106525a338f493dacec34a99b9969b8e3a749012092502535c
                                                                                                    • Opcode Fuzzy Hash: 68a2aa27507458688e090ed022a6fce13e26b8886039bd0570df0eb02f9b5fbf
                                                                                                    • Instruction Fuzzy Hash: FF322322D29F514DD7239635CD22336A688AFB73C5F15D737F81AB5EAAEB28C4834100
                                                                                                    Function 003C96C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __itow__swprintf
                                                                                                    • String ID:
                                                                                                    • API String ID: 674341424-0
                                                                                                    • Opcode ID: 37dbe3f08e45deaae96d7d4672be84e33c1e1fdc7498f5d0f9b79a94cd241ed9
                                                                                                    • Instruction ID: 380e1df1b20aaa2e2e72a4385d13c2ee4345fc8799997e0c5fcbdcf4a54cb0c4
                                                                                                    • Opcode Fuzzy Hash: 37dbe3f08e45deaae96d7d4672be84e33c1e1fdc7498f5d0f9b79a94cd241ed9
                                                                                                    • Instruction Fuzzy Hash: C622AA725083019FD726DF24C895B6FB7E4AF88304F11492EF89A9B291DB75ED44CB82
                                                                                                    Function 003F038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: 5dbf33ad5b8779a9e4df695d656c5d2cb5dcee955286088bfeb09ba453a854aa
                                                                                                    • Instruction ID: fa57ea67a4b4e88f723a1b79b1daece007ab989a5bb31b7573bf63f8b1de2d63
                                                                                                    • Opcode Fuzzy Hash: 5dbf33ad5b8779a9e4df695d656c5d2cb5dcee955286088bfeb09ba453a854aa
                                                                                                    • Instruction Fuzzy Hash: 1EB1F120D2AF404DD22396398831337B65CAFBB6D6F92D72BFC1A74D62EB2181834180
                                                                                                    Function 0040B6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __time64.LIBCMT ref: 0040B6DF
                                                                                                      • Part of subcall function 003E344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,0040BDC3,00000000,?,?,?,?,0040BF70,00000000,?), ref: 003E3453
                                                                                                      • Part of subcall function 003E344A: __aulldiv.LIBCMT ref: 003E3473
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Time$FileSystem__aulldiv__time64
                                                                                                    • String ID:
                                                                                                    • API String ID: 2893107130-0
                                                                                                    • Opcode ID: 5cdde98e1a750e8a14f3acb8f3d80bf8a21ab52f8e7c6c516fb1dafc440fb55a
                                                                                                    • Instruction ID: 88ba59dea987ca2139cc50158a923efb5a544d1563ef3694fb4a1b81590db72d
                                                                                                    • Opcode Fuzzy Hash: 5cdde98e1a750e8a14f3acb8f3d80bf8a21ab52f8e7c6c516fb1dafc440fb55a
                                                                                                    • Instruction Fuzzy Hash: E32190726346108BC729CF29C881A56B7E1EB95711B248E7DE4E5CB2C0CB78A905CB98
                                                                                                    Function 00416AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • BlockInput.USER32(00000001), ref: 00416ACA
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: BlockInput
                                                                                                    • String ID:
                                                                                                    • API String ID: 3456056419-0
                                                                                                    • Opcode ID: bf010be5ac4bc34e9b028f643a87aea25b9dc550e1df6d02e44f53fd5dffbdce
                                                                                                    • Instruction ID: bb126dd66469726cdfb7431372e2665c4981fbd05c7c252e9836bdaa9ebbf6b5
                                                                                                    • Opcode Fuzzy Hash: bf010be5ac4bc34e9b028f643a87aea25b9dc550e1df6d02e44f53fd5dffbdce
                                                                                                    • Instruction Fuzzy Hash: 51E012362102046FC700EB59D804E96B7ECAFB5751B058427F945D7351DAB4E8448B90
                                                                                                    Function 004074E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 0040750A
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: mouse_event
                                                                                                    • String ID:
                                                                                                    • API String ID: 2434400541-0
                                                                                                    • Opcode ID: 8956d044e1d7dfd8dc00eb62ed04b8f1928d4a4f0796c0f2bb30f11c8b48e6f6
                                                                                                    • Instruction ID: dcae465223c6e5e7e5a8464354959fc078cf912edc8fa95ebc7801139ccf1f15
                                                                                                    • Opcode Fuzzy Hash: 8956d044e1d7dfd8dc00eb62ed04b8f1928d4a4f0796c0f2bb30f11c8b48e6f6
                                                                                                    • Instruction Fuzzy Hash: 6AD067A496C60579E8190B249C1FFB71508B301781FD4456B7602B95C1A8F87D02A07B
                                                                                                    Function 003FB106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,003FAD3E), ref: 003FB124
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: LogonUser
                                                                                                    • String ID:
                                                                                                    • API String ID: 1244722697-0
                                                                                                    • Opcode ID: 5a8170b5bfd8c84f184fd12f02944aad0ad82bf1f5bb53870084ff04ca6b8f98
                                                                                                    • Instruction ID: ac7e7b74962d68e9d877c6b89a47313b2528c584520d6726eaadeaf47d0c24d6
                                                                                                    • Opcode Fuzzy Hash: 5a8170b5bfd8c84f184fd12f02944aad0ad82bf1f5bb53870084ff04ca6b8f98
                                                                                                    • Instruction Fuzzy Hash: C7D05E321A460EAEDF024FA4DC02EAE3F6AEB04700F408110FA11D60A0C671D531AB50
                                                                                                    Function 0043B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: NameUser
                                                                                                    • String ID:
                                                                                                    • API String ID: 2645101109-0
                                                                                                    • Opcode ID: 2c517ac4703e635fc2eb52bda7df92b6878aaba94f4d80f5dfe1ba89e155365e
                                                                                                    • Instruction ID: 3096b8ef906970d52b88009fa0c8f5e7cbd242c76abea03ea781bf01d7bdffd0
                                                                                                    • Opcode Fuzzy Hash: 2c517ac4703e635fc2eb52bda7df92b6878aaba94f4d80f5dfe1ba89e155365e
                                                                                                    • Instruction Fuzzy Hash: BEC04CB1800109DFC751CFC0C9449EEB7BCAB08305F1050929145F2110D7749B469B76
                                                                                                    Function 003E8189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SetUnhandledExceptionFilter.KERNEL32(?), ref: 003E818F
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ExceptionFilterUnhandled
                                                                                                    • String ID:
                                                                                                    • API String ID: 3192549508-0
                                                                                                    • Opcode ID: d2b845569bc1875def8312fc519740cae144863a3fdd441ec28b3a40b71aa7ab
                                                                                                    • Instruction ID: 3e9149751a8ba37406bcb43649c5971beda92679c00c2ae13fbb4041f12faf75
                                                                                                    • Opcode Fuzzy Hash: d2b845569bc1875def8312fc519740cae144863a3fdd441ec28b3a40b71aa7ab
                                                                                                    • Instruction Fuzzy Hash: F1A0223000020CFBCF002F82FC088883FACFB022A0B000030FC0C00030CB33A8208AEA
                                                                                                    Function 003C93F0 Relevance: .5, Instructions: 531COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: f6e998a678e50c1214c501491c4f0910287a15f6fa6c877a2d66cfd157d5ffa2
                                                                                                    • Instruction ID: 02257b5c64f2dda88e8e93f0f01c17063081f2b184c5f61aaa1f754cc13d5301
                                                                                                    • Opcode Fuzzy Hash: f6e998a678e50c1214c501491c4f0910287a15f6fa6c877a2d66cfd157d5ffa2
                                                                                                    • Instruction Fuzzy Hash: 22127C70A006099FDF05DFA5DA85BAEB7F5FF48300F21456AE406EB290EB35AD21CB54
                                                                                                    Function 003CE3E3 Relevance: .5, Instructions: 521COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: 60d5b9ba028bf49063c80594106c22927ebfc26332ffb91fa7e7728fbd48d080
                                                                                                    • Instruction ID: 392243bb6138ed4e5e600786a658fa566c815723f6eee3cd3af066ec76550bc1
                                                                                                    • Opcode Fuzzy Hash: 60d5b9ba028bf49063c80594106c22927ebfc26332ffb91fa7e7728fbd48d080
                                                                                                    • Instruction Fuzzy Hash: 36129CB5A042058FDB26DF54D480FAAB7B1FF18304F15806EE986EB351E735AD81CB91
                                                                                                    Function 003CAF50 Relevance: .5, Instructions: 514COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Exception@8Throwstd::exception::exception
                                                                                                    • String ID:
                                                                                                    • API String ID: 3728558374-0
                                                                                                    • Opcode ID: b9c194ea050ce234a3ff580eeddbfd0733435a0ce96225e12ddfa4b5c676e8d7
                                                                                                    • Instruction ID: cdfeb0773387646da31fb8ffa1df5848d6d5508a5be594d6344f87050d49cd3f
                                                                                                    • Opcode Fuzzy Hash: b9c194ea050ce234a3ff580eeddbfd0733435a0ce96225e12ddfa4b5c676e8d7
                                                                                                    • Instruction Fuzzy Hash: 8402A0B1A00105DFCF05DF64D982AAEBBB5EF48300F14806AE806EF255EB75DD11CB95
                                                                                                    Function 003E02A4 Relevance: .3, Instructions: 345COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                                                                    • Instruction ID: ae541aba2f0255707b3175870a8cec732eb4f09094323e9b2aa8f9757b89bce6
                                                                                                    • Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                                                                    • Instruction Fuzzy Hash: 0FC1B2332051F30ADF2E463A947453EBBA15AA27B131B076ED8B3CB5D5EF60C564DA20
                                                                                                    Function 003E06D9 Relevance: .3, Instructions: 341COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                                                                    • Instruction ID: 31fe804328201f3ce54fc60906611f9789fa2103cdf4e70af2fbcf3af74c3851
                                                                                                    • Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                                                                    • Instruction Fuzzy Hash: 5CC1A1332051F309DF2E463A947443EBBA15AA2BB131B076EE4B3CB5D6EF60D564D620
                                                                                                    Function 003DFA57 Relevance: .3, Instructions: 323COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                                                    • Instruction ID: 49c5b983cf11ba9519daf6b7c3ef60fdda130589b7902fac6ca755f4d5d6b0fa
                                                                                                    • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                                                    • Instruction Fuzzy Hash: EAC160332051A30DDF2E4639A4B443EBBA15AA2BB531B077FD4B3CB6D5EE20D564D620
                                                                                                    Function 0041A2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • DeleteObject.GDI32(00000000), ref: 0041A2FE
                                                                                                    • DeleteObject.GDI32(00000000), ref: 0041A310
                                                                                                    • DestroyWindow.USER32 ref: 0041A31E
                                                                                                    • GetDesktopWindow.USER32 ref: 0041A338
                                                                                                    • GetWindowRect.USER32(00000000), ref: 0041A33F
                                                                                                    • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 0041A480
                                                                                                    • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 0041A490
                                                                                                    • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0041A4D8
                                                                                                    • GetClientRect.USER32(00000000,?), ref: 0041A4E4
                                                                                                    • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0041A51E
                                                                                                    • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0041A540
                                                                                                    • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0041A553
                                                                                                    • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0041A55E
                                                                                                    • GlobalLock.KERNEL32(00000000), ref: 0041A567
                                                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0041A576
                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 0041A57F
                                                                                                    • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0041A586
                                                                                                    • GlobalFree.KERNEL32(00000000), ref: 0041A591
                                                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0041A5A3
                                                                                                    • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,0044D9BC,00000000), ref: 0041A5B9
                                                                                                    • GlobalFree.KERNEL32(00000000), ref: 0041A5C9
                                                                                                    • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 0041A5EF
                                                                                                    • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 0041A60E
                                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0041A630
                                                                                                    • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0041A81D
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                                                    • String ID: $AutoIt v3$DISPLAY$static
                                                                                                    • API String ID: 2211948467-2373415609
                                                                                                    • Opcode ID: 33161db63fd0dbb8a8610d34d485e560d65d0f57ce33f81be430f1547fcd3143
                                                                                                    • Instruction ID: 8984b618efc3dc95afcebbc82fb6b1b36e667cc9440bbd6ef2bd9eeb407da2e7
                                                                                                    • Opcode Fuzzy Hash: 33161db63fd0dbb8a8610d34d485e560d65d0f57ce33f81be430f1547fcd3143
                                                                                                    • Instruction Fuzzy Hash: A9029C75900208EFDB14DFA4CD89EAE7BB9FB49310F10812AF915AB2A1C774ED41CB65
                                                                                                    Function 0042D285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SetTextColor.GDI32(?,00000000), ref: 0042D2DB
                                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 0042D30C
                                                                                                    • GetSysColor.USER32(0000000F), ref: 0042D318
                                                                                                    • SetBkColor.GDI32(?,000000FF), ref: 0042D332
                                                                                                    • SelectObject.GDI32(?,00000000), ref: 0042D341
                                                                                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 0042D36C
                                                                                                    • GetSysColor.USER32(00000010), ref: 0042D374
                                                                                                    • CreateSolidBrush.GDI32(00000000), ref: 0042D37B
                                                                                                    • FrameRect.USER32(?,?,00000000), ref: 0042D38A
                                                                                                    • DeleteObject.GDI32(00000000), ref: 0042D391
                                                                                                    • InflateRect.USER32(?,000000FE,000000FE), ref: 0042D3DC
                                                                                                    • FillRect.USER32(?,?,00000000), ref: 0042D40E
                                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 0042D439
                                                                                                      • Part of subcall function 0042D575: GetSysColor.USER32(00000012), ref: 0042D5AE
                                                                                                      • Part of subcall function 0042D575: SetTextColor.GDI32(?,?), ref: 0042D5B2
                                                                                                      • Part of subcall function 0042D575: GetSysColorBrush.USER32(0000000F), ref: 0042D5C8
                                                                                                      • Part of subcall function 0042D575: GetSysColor.USER32(0000000F), ref: 0042D5D3
                                                                                                      • Part of subcall function 0042D575: GetSysColor.USER32(00000011), ref: 0042D5F0
                                                                                                      • Part of subcall function 0042D575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0042D5FE
                                                                                                      • Part of subcall function 0042D575: SelectObject.GDI32(?,00000000), ref: 0042D60F
                                                                                                      • Part of subcall function 0042D575: SetBkColor.GDI32(?,00000000), ref: 0042D618
                                                                                                      • Part of subcall function 0042D575: SelectObject.GDI32(?,?), ref: 0042D625
                                                                                                      • Part of subcall function 0042D575: InflateRect.USER32(?,000000FF,000000FF), ref: 0042D644
                                                                                                      • Part of subcall function 0042D575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0042D65B
                                                                                                      • Part of subcall function 0042D575: GetWindowLongW.USER32(00000000,000000F0), ref: 0042D670
                                                                                                      • Part of subcall function 0042D575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0042D698
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                                                                    • String ID:
                                                                                                    • API String ID: 3521893082-0
                                                                                                    • Opcode ID: 0f38cbc0cd9f3c4523eda5466428d74f4ffa03c93960e06d74f53221a2d6cee4
                                                                                                    • Instruction ID: 8b3d217f733171e34a2c6bf6ff3fe3ac5b5ebbc33901ca905d01816a444d4ba7
                                                                                                    • Opcode Fuzzy Hash: 0f38cbc0cd9f3c4523eda5466428d74f4ffa03c93960e06d74f53221a2d6cee4
                                                                                                    • Instruction Fuzzy Hash: 9E91D276908311BFD710DF60DC08E6B7BA9FF8A325F500A29F962961E0CB74D940CB56
                                                                                                    Function 003DB8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • DestroyWindow.USER32 ref: 003DB98B
                                                                                                    • DeleteObject.GDI32(00000000), ref: 003DB9CD
                                                                                                    • DeleteObject.GDI32(00000000), ref: 003DB9D8
                                                                                                    • DestroyIcon.USER32(00000000), ref: 003DB9E3
                                                                                                    • DestroyWindow.USER32(00000000), ref: 003DB9EE
                                                                                                    • SendMessageW.USER32(?,00001308,?,00000000), ref: 0043D2AA
                                                                                                    • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0043D2E3
                                                                                                    • MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 0043D711
                                                                                                      • Part of subcall function 003DB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,003DB759,?,00000000,?,?,?,?,003DB72B,00000000,?), ref: 003DBA58
                                                                                                    • SendMessageW.USER32 ref: 0043D758
                                                                                                    • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0043D76F
                                                                                                    • ImageList_Destroy.COMCTL32(00000000), ref: 0043D785
                                                                                                    • ImageList_Destroy.COMCTL32(00000000), ref: 0043D790
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                                                                    • String ID: 0
                                                                                                    • API String ID: 464785882-4108050209
                                                                                                    • Opcode ID: da5b929392b6abd54dab404efe7fff7d86c67a366b0c3425062569ffd7449cbd
                                                                                                    • Instruction ID: 1171d8f63519c717ff35b21eb639523fd22958889602592f11f59de7fc4d18fd
                                                                                                    • Opcode Fuzzy Hash: da5b929392b6abd54dab404efe7fff7d86c67a366b0c3425062569ffd7449cbd
                                                                                                    • Instruction Fuzzy Hash: F012CC75A00241EFCB21CF24E894BAABBE4FF09304F14556AE989CB762C735EC41CB95
                                                                                                    Function 0040DBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0040DBD6
                                                                                                    • GetDriveTypeW.KERNEL32(?,0045DC54,?,\\.\,0045DC00), ref: 0040DCC3
                                                                                                    • SetErrorMode.KERNEL32(00000000,0045DC54,?,\\.\,0045DC00), ref: 0040DE29
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorMode$DriveType
                                                                                                    • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                                                    • API String ID: 2907320926-4222207086
                                                                                                    • Opcode ID: 7ccca2852caa67396774bc4a330f9f8ed4cde057bb866af3f992b3e9ca6fe473
                                                                                                    • Instruction ID: 62b55d3abd1b0b7ecdf66e493f892a868d1097a5c8f6c632e774114997b02d72
                                                                                                    • Opcode Fuzzy Hash: 7ccca2852caa67396774bc4a330f9f8ed4cde057bb866af3f992b3e9ca6fe473
                                                                                                    • Instruction Fuzzy Hash: 5A518630A487019BC614DF50C841A69B7A1FF94705B24453FF44BBB2D2CA78E94AE74F
                                                                                                    Function 003CCC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __wcsnicmp
                                                                                                    • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                                                    • API String ID: 1038674560-86951937
                                                                                                    • Opcode ID: ec813ac4ec2f9e081b226c8074934781e4e0b9923a24a13e1752e96b80fc276e
                                                                                                    • Instruction ID: c46b69aa4d9563c2d676473695d52a990303b60452957e6c9f29369a1a9ed35d
                                                                                                    • Opcode Fuzzy Hash: ec813ac4ec2f9e081b226c8074934781e4e0b9923a24a13e1752e96b80fc276e
                                                                                                    • Instruction Fuzzy Hash: FF81F731650215BACB23AA64DD83FBB7768AF18301F14502EF90AEE1C6EBA4DD45C395
                                                                                                    Function 0042C6E9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 0042C788
                                                                                                    • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0042C83E
                                                                                                    • SendMessageW.USER32(?,00001102,00000002,?), ref: 0042C859
                                                                                                    • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0042CB15
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$Window
                                                                                                    • String ID: 0
                                                                                                    • API String ID: 2326795674-4108050209
                                                                                                    • Opcode ID: e12ef6aca7536cc499707fce50fdb98edcbc21005d40ba6efbb1aa38faccb39c
                                                                                                    • Instruction ID: b5ecb4ded4df9cc51495fc44ac4c466407849d1841c33d6f05da4b3e4732dce0
                                                                                                    • Opcode Fuzzy Hash: e12ef6aca7536cc499707fce50fdb98edcbc21005d40ba6efbb1aa38faccb39c
                                                                                                    • Instruction Fuzzy Hash: 73F1D071704321AFD7218F24E885BAFBBE4FF49354F48452EF588962A1C778D841CB9A
                                                                                                    Function 0042638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CharUpperBuffW.USER32(?,?,0045DC00), ref: 00426449
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: BuffCharUpper
                                                                                                    • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                                                                    • API String ID: 3964851224-45149045
                                                                                                    • Opcode ID: f11c43b0bcdb35e51a69e631edfdb23058d04de7e179b5653aa14f482f5d561a
                                                                                                    • Instruction ID: 1ae42b18604cde7f1f66338ff3929cb71e8a2df7327d0008b3383b5401b1c971
                                                                                                    • Opcode Fuzzy Hash: f11c43b0bcdb35e51a69e631edfdb23058d04de7e179b5653aa14f482f5d561a
                                                                                                    • Instruction Fuzzy Hash: 31C1B3303042558BCB05FF10E551A7EB795AF94344F51885EF8895F3A2DB28ED0BCB8A
                                                                                                    Function 0042D575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetSysColor.USER32(00000012), ref: 0042D5AE
                                                                                                    • SetTextColor.GDI32(?,?), ref: 0042D5B2
                                                                                                    • GetSysColorBrush.USER32(0000000F), ref: 0042D5C8
                                                                                                    • GetSysColor.USER32(0000000F), ref: 0042D5D3
                                                                                                    • CreateSolidBrush.GDI32(?), ref: 0042D5D8
                                                                                                    • GetSysColor.USER32(00000011), ref: 0042D5F0
                                                                                                    • CreatePen.GDI32(00000000,00000001,00743C00), ref: 0042D5FE
                                                                                                    • SelectObject.GDI32(?,00000000), ref: 0042D60F
                                                                                                    • SetBkColor.GDI32(?,00000000), ref: 0042D618
                                                                                                    • SelectObject.GDI32(?,?), ref: 0042D625
                                                                                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 0042D644
                                                                                                    • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0042D65B
                                                                                                    • GetWindowLongW.USER32(00000000,000000F0), ref: 0042D670
                                                                                                    • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0042D698
                                                                                                    • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0042D6BF
                                                                                                    • InflateRect.USER32(?,000000FD,000000FD), ref: 0042D6DD
                                                                                                    • DrawFocusRect.USER32(?,?), ref: 0042D6E8
                                                                                                    • GetSysColor.USER32(00000011), ref: 0042D6F6
                                                                                                    • SetTextColor.GDI32(?,00000000), ref: 0042D6FE
                                                                                                    • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0042D712
                                                                                                    • SelectObject.GDI32(?,0042D2A5), ref: 0042D729
                                                                                                    • DeleteObject.GDI32(?), ref: 0042D734
                                                                                                    • SelectObject.GDI32(?,?), ref: 0042D73A
                                                                                                    • DeleteObject.GDI32(?), ref: 0042D73F
                                                                                                    • SetTextColor.GDI32(?,?), ref: 0042D745
                                                                                                    • SetBkColor.GDI32(?,?), ref: 0042D74F
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                    • String ID:
                                                                                                    • API String ID: 1996641542-0
                                                                                                    • Opcode ID: e3b0a0c4e2192bd97e9f96423c96918d08340cc090df4ada7513a0483ba929c4
                                                                                                    • Instruction ID: b4a082e01ab208eebc684601f4fcd48ee9f0a088799c266ea036ef9b701fefdf
                                                                                                    • Opcode Fuzzy Hash: e3b0a0c4e2192bd97e9f96423c96918d08340cc090df4ada7513a0483ba929c4
                                                                                                    • Instruction Fuzzy Hash: 10515B76E00218BFDB119FA8DC48EAE7B79FF09324F204126F915AB2A1D7759A40CF54
                                                                                                    Function 0042B6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0042B7B0
                                                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0042B7C1
                                                                                                    • CharNextW.USER32(0000014E), ref: 0042B7F0
                                                                                                    • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 0042B831
                                                                                                    • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 0042B847
                                                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0042B858
                                                                                                    • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 0042B875
                                                                                                    • SetWindowTextW.USER32(?,0000014E), ref: 0042B8C7
                                                                                                    • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 0042B8DD
                                                                                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 0042B90E
                                                                                                    • _memset.LIBCMT ref: 0042B933
                                                                                                    • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 0042B97C
                                                                                                    • _memset.LIBCMT ref: 0042B9DB
                                                                                                    • SendMessageW.USER32 ref: 0042BA05
                                                                                                    • SendMessageW.USER32(?,00001074,?,00000001), ref: 0042BA5D
                                                                                                    • SendMessageW.USER32(?,0000133D,?,?), ref: 0042BB0A
                                                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 0042BB2C
                                                                                                    • GetMenuItemInfoW.USER32(?), ref: 0042BB76
                                                                                                    • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0042BBA3
                                                                                                    • DrawMenuBar.USER32(?), ref: 0042BBB2
                                                                                                    • SetWindowTextW.USER32(?,0000014E), ref: 0042BBDA
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                                                                    • String ID: 0
                                                                                                    • API String ID: 1073566785-4108050209
                                                                                                    • Opcode ID: a6820f3cc8e962d478f1bc248084fc6d8efcc747b6a69398192e611b9e1431e1
                                                                                                    • Instruction ID: 6bca557f2e5362429601e56bab80ea9d7b766e492ec8e9259efc5dbb62070152
                                                                                                    • Opcode Fuzzy Hash: a6820f3cc8e962d478f1bc248084fc6d8efcc747b6a69398192e611b9e1431e1
                                                                                                    • Instruction Fuzzy Hash: 35E1C174A00228ABDF119F91DC84EEF7B78FF05310F548157F919AA290D7789981CFA9
                                                                                                    Function 003C2EC0 Relevance: 37.1, APIs: 8, Strings: 13, Instructions: 346COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$Foreground
                                                                                                    • String ID: ACTIVE$ALL$CLASS$H+G$HANDLE$INSTANCE$L+G$LAST$P+G$REGEXPCLASS$REGEXPTITLE$T+G$TITLE
                                                                                                    • API String ID: 62970417-1838082749
                                                                                                    • Opcode ID: e1d65e654c95e630b8b9b61c6db0ee3e7a609ffbf9f2b32c391d187610abe759
                                                                                                    • Instruction ID: 0068555d129ef790c52f3b47809e72c62684e8620661011e0b3b53b3fcf5a5f0
                                                                                                    • Opcode Fuzzy Hash: e1d65e654c95e630b8b9b61c6db0ee3e7a609ffbf9f2b32c391d187610abe759
                                                                                                    • Instruction Fuzzy Hash: BFD1F930504646DBCB05EF20CA41A9BBBB0FF58340F108A1FF4559B6A1DBB4ED5ACB95
                                                                                                    Function 0042764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetCursorPos.USER32(?), ref: 0042778A
                                                                                                    • GetDesktopWindow.USER32 ref: 0042779F
                                                                                                    • GetWindowRect.USER32(00000000), ref: 004277A6
                                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 00427808
                                                                                                    • DestroyWindow.USER32(?), ref: 00427834
                                                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0042785D
                                                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0042787B
                                                                                                    • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 004278A1
                                                                                                    • SendMessageW.USER32(?,00000421,?,?), ref: 004278B6
                                                                                                    • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004278C9
                                                                                                    • IsWindowVisible.USER32(?), ref: 004278E9
                                                                                                    • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00427904
                                                                                                    • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00427918
                                                                                                    • GetWindowRect.USER32(?,?), ref: 00427930
                                                                                                    • MonitorFromPoint.USER32(?,?,00000002), ref: 00427956
                                                                                                    • GetMonitorInfoW.USER32 ref: 00427970
                                                                                                    • CopyRect.USER32(?,?), ref: 00427987
                                                                                                    • SendMessageW.USER32(?,00000412,00000000), ref: 004279F2
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                                                    • String ID: ($0$tooltips_class32
                                                                                                    • API String ID: 698492251-4156429822
                                                                                                    • Opcode ID: 2f224d46b89dff2926e53e3ed122d2ef09572d650bf120a4534a646e19f91830
                                                                                                    • Instruction ID: 85da609b5223af94677ad0ca7da666efa1e13affc3d7448796f640c2687bec4d
                                                                                                    • Opcode Fuzzy Hash: 2f224d46b89dff2926e53e3ed122d2ef09572d650bf120a4534a646e19f91830
                                                                                                    • Instruction Fuzzy Hash: 04B19B71608310AFDB04DF64D948B6ABBE4FF89310F40891EF5999B291DB74EC05CB9A
                                                                                                    Function 00406CE9 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00406CFB
                                                                                                    • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00406D21
                                                                                                    • _wcscpy.LIBCMT ref: 00406D4F
                                                                                                    • _wcscmp.LIBCMT ref: 00406D5A
                                                                                                    • _wcscat.LIBCMT ref: 00406D70
                                                                                                    • _wcsstr.LIBCMT ref: 00406D7B
                                                                                                    • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00406D97
                                                                                                    • _wcscat.LIBCMT ref: 00406DE0
                                                                                                    • _wcscat.LIBCMT ref: 00406DE7
                                                                                                    • _wcsncpy.LIBCMT ref: 00406E12
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
                                                                                                    • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                    • API String ID: 699586101-1459072770
                                                                                                    • Opcode ID: b1dfaae0990ea4183876891d2e0c4c7188482f1454659b60dbf3220fbb65d7e3
                                                                                                    • Instruction ID: 54693d6d7ec3b0c4bed830e6853cf6d088760da32df9551614b223656efebac9
                                                                                                    • Opcode Fuzzy Hash: b1dfaae0990ea4183876891d2e0c4c7188482f1454659b60dbf3220fbb65d7e3
                                                                                                    • Instruction Fuzzy Hash: 17412A729002507BE716AB65DC43EBF77BCDF01310F10016BF906BA2C2EB789A1196A9
                                                                                                    Function 003DA856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 003DA939
                                                                                                    • GetSystemMetrics.USER32(00000007), ref: 003DA941
                                                                                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 003DA96C
                                                                                                    • GetSystemMetrics.USER32(00000008), ref: 003DA974
                                                                                                    • GetSystemMetrics.USER32(00000004), ref: 003DA999
                                                                                                    • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 003DA9B6
                                                                                                    • AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 003DA9C6
                                                                                                    • CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 003DA9F9
                                                                                                    • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 003DAA0D
                                                                                                    • GetClientRect.USER32(00000000,000000FF), ref: 003DAA2B
                                                                                                    • GetStockObject.GDI32(00000011), ref: 003DAA47
                                                                                                    • SendMessageW.USER32(00000000,00000030,00000000), ref: 003DAA52
                                                                                                      • Part of subcall function 003DB63C: GetCursorPos.USER32(000000FF), ref: 003DB64F
                                                                                                      • Part of subcall function 003DB63C: ScreenToClient.USER32(00000000,000000FF), ref: 003DB66C
                                                                                                      • Part of subcall function 003DB63C: GetAsyncKeyState.USER32(00000001), ref: 003DB691
                                                                                                      • Part of subcall function 003DB63C: GetAsyncKeyState.USER32(00000002), ref: 003DB69F
                                                                                                    • SetTimer.USER32(00000000,00000000,00000028,003DAB87), ref: 003DAA79
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                                                    • String ID: AutoIt v3 GUI
                                                                                                    • API String ID: 1458621304-248962490
                                                                                                    • Opcode ID: 96ab0a92278173077c5344158ff17ebf62009dad922bd71dcc6b7565503e98b3
                                                                                                    • Instruction ID: de5088f6543d5994d4a74da3b9e14ef84689c14a935036f4e01553680d45cec9
                                                                                                    • Opcode Fuzzy Hash: 96ab0a92278173077c5344158ff17ebf62009dad922bd71dcc6b7565503e98b3
                                                                                                    • Instruction Fuzzy Hash: 6FB1A275A0020ADFDB15DFA8ED45BAE7BB8FB08314F11422AFA15A73A0DB34D841CB55
                                                                                                    Function 00423639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00423735
                                                                                                    • RegCreateKeyExW.ADVAPI32(?,?,00000000,0045DC00,00000000,?,00000000,?,?), ref: 004237A3
                                                                                                    • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 004237EB
                                                                                                    • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00423874
                                                                                                    • RegCloseKey.ADVAPI32(?), ref: 00423B94
                                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 00423BA1
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Close$ConnectCreateRegistryValue
                                                                                                    • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                                                    • API String ID: 536824911-966354055
                                                                                                    • Opcode ID: 5f0212a204e7e5de438d8061800eee02255bef2e82a238683aa3b88a4da4cea2
                                                                                                    • Instruction ID: 197275a9d39549e0411918d2a6aac884269094b19c0d22c472e8b949f0a0536e
                                                                                                    • Opcode Fuzzy Hash: 5f0212a204e7e5de438d8061800eee02255bef2e82a238683aa3b88a4da4cea2
                                                                                                    • Instruction Fuzzy Hash: 680267756006119FCB15EF14D885E2AB7E5FF89720F04845EF98A9B3A2CB38ED01CB85
                                                                                                    Function 00426BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CharUpperBuffW.USER32(?,?), ref: 00426C56
                                                                                                    • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00426D16
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: BuffCharMessageSendUpper
                                                                                                    • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                                                                    • API String ID: 3974292440-719923060
                                                                                                    • Opcode ID: 8cbdeb6ad6295946929812f50c325a347989179ddd0a4676c6c460eb7eeba5b2
                                                                                                    • Instruction ID: 814eb49c1379ad4debb5178bc8e851b731ffd212f4adc5a0c5dd5a3ac3755aa4
                                                                                                    • Opcode Fuzzy Hash: 8cbdeb6ad6295946929812f50c325a347989179ddd0a4676c6c460eb7eeba5b2
                                                                                                    • Instruction Fuzzy Hash: 07A1AF713102519BCB15EF20E851A7BB3A5BF84310F51886EB8569F3D2DB34ED06CB86
                                                                                                    Function 003FCF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 003FCF91
                                                                                                    • __swprintf.LIBCMT ref: 003FD032
                                                                                                    • _wcscmp.LIBCMT ref: 003FD045
                                                                                                    • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 003FD09A
                                                                                                    • _wcscmp.LIBCMT ref: 003FD0D6
                                                                                                    • GetClassNameW.USER32(?,?,00000400), ref: 003FD10D
                                                                                                    • GetDlgCtrlID.USER32(?), ref: 003FD15F
                                                                                                    • GetWindowRect.USER32(?,?), ref: 003FD195
                                                                                                    • GetParent.USER32(?), ref: 003FD1B3
                                                                                                    • ScreenToClient.USER32(00000000), ref: 003FD1BA
                                                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 003FD234
                                                                                                    • _wcscmp.LIBCMT ref: 003FD248
                                                                                                    • GetWindowTextW.USER32(?,?,00000400), ref: 003FD26E
                                                                                                    • _wcscmp.LIBCMT ref: 003FD282
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
                                                                                                    • String ID: %s%u
                                                                                                    • API String ID: 3119225716-679674701
                                                                                                    • Opcode ID: 46c5bcf39c88aafc08cc1141c4ec22ccbbc92da4439bf6725925e98323cea480
                                                                                                    • Instruction ID: 6d2fca86b4544d7c06c16af486cda585c5a88dc07117b08f8013e439dc98d6e2
                                                                                                    • Opcode Fuzzy Hash: 46c5bcf39c88aafc08cc1141c4ec22ccbbc92da4439bf6725925e98323cea480
                                                                                                    • Instruction Fuzzy Hash: DFA1C37160430AAFD716DF64C888FBAB7A9FF44354F004A2AFA59D6190DB30EA45CBD1
                                                                                                    Function 003FD8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetClassNameW.USER32(00000008,?,00000400), ref: 003FD8EB
                                                                                                    • _wcscmp.LIBCMT ref: 003FD8FC
                                                                                                    • GetWindowTextW.USER32(00000001,?,00000400), ref: 003FD924
                                                                                                    • CharUpperBuffW.USER32(?,00000000), ref: 003FD941
                                                                                                    • _wcscmp.LIBCMT ref: 003FD95F
                                                                                                    • _wcsstr.LIBCMT ref: 003FD970
                                                                                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 003FD9A8
                                                                                                    • _wcscmp.LIBCMT ref: 003FD9B8
                                                                                                    • GetWindowTextW.USER32(00000002,?,00000400), ref: 003FD9DF
                                                                                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 003FDA28
                                                                                                    • _wcscmp.LIBCMT ref: 003FDA38
                                                                                                    • GetClassNameW.USER32(00000010,?,00000400), ref: 003FDA60
                                                                                                    • GetWindowRect.USER32(00000004,?), ref: 003FDAC9
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                                                                    • String ID: @$ThumbnailClass
                                                                                                    • API String ID: 1788623398-1539354611
                                                                                                    • Opcode ID: b66b6f692bc9328dd32f7cf079843db3fd78bd880ca66c721286bbeb7f23f990
                                                                                                    • Instruction ID: a61183a90933628a47e3af7d026e53a3a08ce9eb8570210fc6f4fe6db926cbec
                                                                                                    • Opcode Fuzzy Hash: b66b6f692bc9328dd32f7cf079843db3fd78bd880ca66c721286bbeb7f23f990
                                                                                                    • Instruction Fuzzy Hash: 0181C2310083499BDB02DF50C889FBA7BE9EF45314F05846AFE8A9A096DB70DD45CBA5
                                                                                                    Function 003FD6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __wcsnicmp
                                                                                                    • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                                                    • API String ID: 1038674560-1810252412
                                                                                                    • Opcode ID: 62ecfaa517ba45588e00a7ba736f6dfc699ab7a445be739a6ec3c0bc4d890e21
                                                                                                    • Instruction ID: 960aed9a2f89c530cc164fe774ebb6e5ce74ae3e45d520166a1524aa955ac9a8
                                                                                                    • Opcode Fuzzy Hash: 62ecfaa517ba45588e00a7ba736f6dfc699ab7a445be739a6ec3c0bc4d890e21
                                                                                                    • Instruction Fuzzy Hash: 14318F31A44209AADB17FE60DE47FFD73B99F20740F30012AF545B90E5EBA5AE04C655
                                                                                                    Function 003FEA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadIconW.USER32(00000063), ref: 003FEAB0
                                                                                                    • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 003FEAC2
                                                                                                    • SetWindowTextW.USER32(?,?), ref: 003FEAD9
                                                                                                    • GetDlgItem.USER32(?,000003EA), ref: 003FEAEE
                                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 003FEAF4
                                                                                                    • GetDlgItem.USER32(?,000003E9), ref: 003FEB04
                                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 003FEB0A
                                                                                                    • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 003FEB2B
                                                                                                    • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 003FEB45
                                                                                                    • GetWindowRect.USER32(?,?), ref: 003FEB4E
                                                                                                    • SetWindowTextW.USER32(?,?), ref: 003FEBB9
                                                                                                    • GetDesktopWindow.USER32 ref: 003FEBBF
                                                                                                    • GetWindowRect.USER32(00000000), ref: 003FEBC6
                                                                                                    • MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 003FEC12
                                                                                                    • GetClientRect.USER32(?,?), ref: 003FEC1F
                                                                                                    • PostMessageW.USER32(?,00000005,00000000,00000000), ref: 003FEC44
                                                                                                    • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 003FEC6F
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                                    • String ID:
                                                                                                    • API String ID: 3869813825-0
                                                                                                    • Opcode ID: d0db6527601376a6d71810e6f5f9600f9500ba9417bf94abaacd828a179fe900
                                                                                                    • Instruction ID: 49b4da1984f5cc3ee0582dbb4ac4745c13e9a5de8b715f9a8c657daa53a9a653
                                                                                                    • Opcode Fuzzy Hash: d0db6527601376a6d71810e6f5f9600f9500ba9417bf94abaacd828a179fe900
                                                                                                    • Instruction Fuzzy Hash: 5B515D75900709EFDB22DFA8CD89F6EBBF5FF04705F014928E686A25A0C774A944CB14
                                                                                                    Function 004179B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadCursorW.USER32(00000000,00007F8A), ref: 004179C6
                                                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 004179D1
                                                                                                    • LoadCursorW.USER32(00000000,00007F03), ref: 004179DC
                                                                                                    • LoadCursorW.USER32(00000000,00007F8B), ref: 004179E7
                                                                                                    • LoadCursorW.USER32(00000000,00007F01), ref: 004179F2
                                                                                                    • LoadCursorW.USER32(00000000,00007F81), ref: 004179FD
                                                                                                    • LoadCursorW.USER32(00000000,00007F88), ref: 00417A08
                                                                                                    • LoadCursorW.USER32(00000000,00007F80), ref: 00417A13
                                                                                                    • LoadCursorW.USER32(00000000,00007F86), ref: 00417A1E
                                                                                                    • LoadCursorW.USER32(00000000,00007F83), ref: 00417A29
                                                                                                    • LoadCursorW.USER32(00000000,00007F85), ref: 00417A34
                                                                                                    • LoadCursorW.USER32(00000000,00007F82), ref: 00417A3F
                                                                                                    • LoadCursorW.USER32(00000000,00007F84), ref: 00417A4A
                                                                                                    • LoadCursorW.USER32(00000000,00007F04), ref: 00417A55
                                                                                                    • LoadCursorW.USER32(00000000,00007F02), ref: 00417A60
                                                                                                    • LoadCursorW.USER32(00000000,00007F89), ref: 00417A6B
                                                                                                    • GetCursorInfo.USER32(?), ref: 00417A7B
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Cursor$Load$Info
                                                                                                    • String ID:
                                                                                                    • API String ID: 2577412497-0
                                                                                                    • Opcode ID: 13a85f0b1ac9c1c10128ddf78204cecc751fa9b3c85e7511f19056483e1c2404
                                                                                                    • Instruction ID: 8ec35ab6a70fba86762fa172788275f8e891371eeb64f325f7075158db4aac3a
                                                                                                    • Opcode Fuzzy Hash: 13a85f0b1ac9c1c10128ddf78204cecc751fa9b3c85e7511f19056483e1c2404
                                                                                                    • Instruction Fuzzy Hash: D23113B1D4831A6ADB109FB68C8999FBFF8FF04750F50452BA50DE7280DA78A5408FA5
                                                                                                    Function 003CC833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DE968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,003CC8B7,?,00002000,?,?,00000000,?,003C419E,?,?,?,0045DC00), ref: 003DE984
                                                                                                      • Part of subcall function 003C660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003C53B1,?,?,003C61FF,?,00000000,00000001,00000000), ref: 003C662F
                                                                                                    • __wsplitpath.LIBCMT ref: 003CC93E
                                                                                                      • Part of subcall function 003E1DFC: __wsplitpath_helper.LIBCMT ref: 003E1E3C
                                                                                                    • _wcscpy.LIBCMT ref: 003CC953
                                                                                                    • _wcscat.LIBCMT ref: 003CC968
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 003CC978
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 003CCABE
                                                                                                      • Part of subcall function 003CB337: _wcscpy.LIBCMT ref: 003CB36F
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
                                                                                                    • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                                                                    • API String ID: 2258743419-1018226102
                                                                                                    • Opcode ID: 6747f8200156f8857463fe6b014217a10922fe6f0bcc300595a2afc84871113c
                                                                                                    • Instruction ID: b247b196b8252f21fd263ee3ca3dccd906af28828549a7d30fd3a7cd448bbf5b
                                                                                                    • Opcode Fuzzy Hash: 6747f8200156f8857463fe6b014217a10922fe6f0bcc300595a2afc84871113c
                                                                                                    • Instruction Fuzzy Hash: D712AC715083419FC726EF64C881EAFBBE4AF89304F04492EF489972A1DB34DE49CB56
                                                                                                    Function 0042CE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 0042CEFB
                                                                                                    • DestroyWindow.USER32(?,?), ref: 0042CF73
                                                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0042CFF4
                                                                                                    • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0042D016
                                                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0042D025
                                                                                                    • DestroyWindow.USER32(?), ref: 0042D042
                                                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,003C0000,00000000), ref: 0042D075
                                                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0042D094
                                                                                                    • GetDesktopWindow.USER32 ref: 0042D0A9
                                                                                                    • GetWindowRect.USER32(00000000), ref: 0042D0B0
                                                                                                    • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0042D0C2
                                                                                                    • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0042D0DA
                                                                                                      • Part of subcall function 003DB526: GetWindowLongW.USER32(?,000000EB), ref: 003DB537
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
                                                                                                    • String ID: 0$tooltips_class32
                                                                                                    • API String ID: 3877571568-3619404913
                                                                                                    • Opcode ID: ba5cdf9dc377875c0ee1772ca7bbe3e2ee862df789727d1b0fb0bca6bbc6a0ce
                                                                                                    • Instruction ID: 7c5129da5da13f349a5ce368bff0f4abd01c05893198025f4f8176f838ce8937
                                                                                                    • Opcode Fuzzy Hash: ba5cdf9dc377875c0ee1772ca7bbe3e2ee862df789727d1b0fb0bca6bbc6a0ce
                                                                                                    • Instruction Fuzzy Hash: 4171DC74640204AFD725CF28DC85F6A77E9EB88308F44492EF985972A1D738EC42CB1A
                                                                                                    Function 0042F351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DB34E: GetWindowLongW.USER32(?,000000EB), ref: 003DB35F
                                                                                                    • DragQueryPoint.SHELL32(?,?), ref: 0042F37A
                                                                                                      • Part of subcall function 0042D7DE: ClientToScreen.USER32(?,?), ref: 0042D807
                                                                                                      • Part of subcall function 0042D7DE: GetWindowRect.USER32(?,?), ref: 0042D87D
                                                                                                      • Part of subcall function 0042D7DE: PtInRect.USER32(?,?,0042ED5A), ref: 0042D88D
                                                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0042F3E3
                                                                                                    • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0042F3EE
                                                                                                    • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0042F411
                                                                                                    • _wcscat.LIBCMT ref: 0042F441
                                                                                                    • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0042F458
                                                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0042F471
                                                                                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 0042F488
                                                                                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 0042F4AA
                                                                                                    • DragFinish.SHELL32(?), ref: 0042F4B1
                                                                                                    • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0042F59C
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                                                                    • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                    • API String ID: 169749273-3440237614
                                                                                                    • Opcode ID: 42cf1f4e8a328ccdbd7801e308093dbd505d7a6fa9e3b24e9e3f5179b2e62b7c
                                                                                                    • Instruction ID: 4430e1a1a5f73dc4eba28cf33b879d58a9ff22b9f4e6a960009331eff05004ed
                                                                                                    • Opcode Fuzzy Hash: 42cf1f4e8a328ccdbd7801e308093dbd505d7a6fa9e3b24e9e3f5179b2e62b7c
                                                                                                    • Instruction Fuzzy Hash: 2B615A71508300AFC301EF60DC85E9FBBF8EF89714F504A2EF595961A1DB749A09CB56
                                                                                                    Function 0040AAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • VariantInit.OLEAUT32(00000000), ref: 0040AB3D
                                                                                                    • VariantCopy.OLEAUT32(?,?), ref: 0040AB46
                                                                                                    • VariantClear.OLEAUT32(?), ref: 0040AB52
                                                                                                    • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 0040AC40
                                                                                                    • __swprintf.LIBCMT ref: 0040AC70
                                                                                                    • VarR8FromDec.OLEAUT32(?,?), ref: 0040AC9C
                                                                                                    • VariantInit.OLEAUT32(?), ref: 0040AD4D
                                                                                                    • SysFreeString.OLEAUT32(00000016), ref: 0040ADDF
                                                                                                    • VariantClear.OLEAUT32(?), ref: 0040AE35
                                                                                                    • VariantClear.OLEAUT32(?), ref: 0040AE44
                                                                                                    • VariantInit.OLEAUT32(00000000), ref: 0040AE80
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
                                                                                                    • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                                                                    • API String ID: 3730832054-3931177956
                                                                                                    • Opcode ID: fb8f548702327e9e3453f8274ac8706c6e9d5065591de874e68982e6ed317a63
                                                                                                    • Instruction ID: 53decaaeb60d5b316ce318581ac8d95ff60ad570815e84f1511950c5f4ac44ec
                                                                                                    • Opcode Fuzzy Hash: fb8f548702327e9e3453f8274ac8706c6e9d5065591de874e68982e6ed317a63
                                                                                                    • Instruction Fuzzy Hash: 11D1BB71A04205DBDB209F65D885B6AB7B5BF04700F18807AE505AF2C1DB7CEC61DBAB
                                                                                                    Function 0042716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CharUpperBuffW.USER32(?,?), ref: 004271FC
                                                                                                    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00427247
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: BuffCharMessageSendUpper
                                                                                                    • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                                                    • API String ID: 3974292440-4258414348
                                                                                                    • Opcode ID: 1edc85893b77182e35bec9ed53eff8a3e4e32dc37e6630a2f055e2b559fbbb89
                                                                                                    • Instruction ID: 45f17bbaeacd277a287bab966809a8c52a5f2ad8352913374d5204c91e185a70
                                                                                                    • Opcode Fuzzy Hash: 1edc85893b77182e35bec9ed53eff8a3e4e32dc37e6630a2f055e2b559fbbb89
                                                                                                    • Instruction Fuzzy Hash: 83916F352046159BCB05FF10D851B6EBBA1BF94310F41885EF8965F3A2DB38ED0ACB96
                                                                                                    Function 003FCB82 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 239COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • EnumChildWindows.USER32(?,003FCF50), ref: 003FCE90
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ChildEnumWindows
                                                                                                    • String ID: 4+G$CLASS$CLASSNN$H+G$INSTANCE$L+G$NAME$P+G$REGEXPCLASS$T+G$TEXT
                                                                                                    • API String ID: 3555792229-456094261
                                                                                                    • Opcode ID: d2645864bdf2344ef21535c42e72f705b2b67f81aaebc60b91c7fca165447f9e
                                                                                                    • Instruction ID: eff46e238b76bd1586b68f102801f70f643577015b2ea6ba785314a912fe119b
                                                                                                    • Opcode Fuzzy Hash: d2645864bdf2344ef21535c42e72f705b2b67f81aaebc60b91c7fca165447f9e
                                                                                                    • Instruction Fuzzy Hash: 3E91C431A5010EAACB1AEF60C581BFEFB75BF14300F50951AEA59EB251DF306959CBD0
                                                                                                    Function 0042E4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0042E5AB
                                                                                                    • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,0042BEAF), ref: 0042E607
                                                                                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0042E647
                                                                                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0042E68C
                                                                                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0042E6C3
                                                                                                    • FreeLibrary.KERNEL32(?,00000004,?,?,?,?,0042BEAF), ref: 0042E6CF
                                                                                                    • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0042E6DF
                                                                                                    • DestroyIcon.USER32(?,?,?,?,?,0042BEAF), ref: 0042E6EE
                                                                                                    • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0042E70B
                                                                                                    • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0042E717
                                                                                                      • Part of subcall function 003E0FA7: __wcsicmp_l.LIBCMT ref: 003E1030
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                                                                    • String ID: .dll$.exe$.icl
                                                                                                    • API String ID: 1212759294-1154884017
                                                                                                    • Opcode ID: 0e49be816a045da223bb0683661da05e2ea006112cf74e70f3245e5ed4ab6fc0
                                                                                                    • Instruction ID: 894da8de9e19dc7160071003aa3177d275b5d30cac6f9f62d79b8bfbd5a655e8
                                                                                                    • Opcode Fuzzy Hash: 0e49be816a045da223bb0683661da05e2ea006112cf74e70f3245e5ed4ab6fc0
                                                                                                    • Instruction Fuzzy Hash: EC61D271A00225FAEB14DF65DC45FFE77A8BB14710F504216F915EA1D0EBB89980CB68
                                                                                                    Function 0040D219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C936C: __swprintf.LIBCMT ref: 003C93AB
                                                                                                      • Part of subcall function 003C936C: __itow.LIBCMT ref: 003C93DF
                                                                                                    • CharLowerBuffW.USER32(?,?), ref: 0040D292
                                                                                                    • GetDriveTypeW.KERNEL32 ref: 0040D2DF
                                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0040D327
                                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0040D35E
                                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0040D38C
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: SendString$BuffCharDriveLowerType__itow__swprintf
                                                                                                    • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                    • API String ID: 1148790751-4113822522
                                                                                                    • Opcode ID: 15c315ade8f8b7b4d094086c4bcacda8b2593ece7c5f9f968ee82c0206fe246e
                                                                                                    • Instruction ID: 85b0b999b1163754b6047db18c49189c523ec05272b9cf0805155c05e80a074e
                                                                                                    • Opcode Fuzzy Hash: 15c315ade8f8b7b4d094086c4bcacda8b2593ece7c5f9f968ee82c0206fe246e
                                                                                                    • Instruction Fuzzy Hash: 10514D755143059FC701EF10D882E5AB7E4FF94714F14886EF889AB2A1DB35EE09CB46
                                                                                                    Function 004026BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00433973,00000016,0000138C,00000016,?,00000016,0045DDB4,00000000,?), ref: 004026F1
                                                                                                    • LoadStringW.USER32(00000000,?,00433973,00000016), ref: 004026FA
                                                                                                    • GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00433973,00000016,0000138C,00000016,?,00000016,0045DDB4,00000000,?,00000016), ref: 0040271C
                                                                                                    • LoadStringW.USER32(00000000,?,00433973,00000016), ref: 0040271F
                                                                                                    • __swprintf.LIBCMT ref: 0040276F
                                                                                                    • __swprintf.LIBCMT ref: 00402780
                                                                                                    • _wprintf.LIBCMT ref: 00402829
                                                                                                    • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00402840
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: HandleLoadModuleString__swprintf$Message_wprintf
                                                                                                    • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                                                    • API String ID: 618562835-2268648507
                                                                                                    • Opcode ID: 20e9c61a9b343759c04753135fe86eb8ff8a6fe0ec69b14f99253ad38e8829bb
                                                                                                    • Instruction ID: fe8db904b76ea3b0ed42e7050ace81f71e6c5976759a142c9ad8ee563fb21a24
                                                                                                    • Opcode Fuzzy Hash: 20e9c61a9b343759c04753135fe86eb8ff8a6fe0ec69b14f99253ad38e8829bb
                                                                                                    • Instruction Fuzzy Hash: 01416472800118BACF15FBE0CE86EEEB778AF15340F100169F505BA0D2EA746F49CB64
                                                                                                    Function 0040D0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0040D0D8
                                                                                                    • __swprintf.LIBCMT ref: 0040D0FA
                                                                                                    • CreateDirectoryW.KERNEL32(?,00000000), ref: 0040D137
                                                                                                    • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0040D15C
                                                                                                    • _memset.LIBCMT ref: 0040D17B
                                                                                                    • _wcsncpy.LIBCMT ref: 0040D1B7
                                                                                                    • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0040D1EC
                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040D1F7
                                                                                                    • RemoveDirectoryW.KERNEL32(?), ref: 0040D200
                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040D20A
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                                                    • String ID: :$\$\??\%s
                                                                                                    • API String ID: 2733774712-3457252023
                                                                                                    • Opcode ID: 5f1eb17561db055ec9e597cc8284fd21760b36aac7a0546c83050c457835cd44
                                                                                                    • Instruction ID: 8ccde7f0278fddb637f438fd23ac2bcf46b8138a688a7a8f358f0efbe255afdd
                                                                                                    • Opcode Fuzzy Hash: 5f1eb17561db055ec9e597cc8284fd21760b36aac7a0546c83050c457835cd44
                                                                                                    • Instruction Fuzzy Hash: A231D6B6900119ABDB21DFA0CC48FEF37BCEF89700F1041B6F509E61A0EB7496448B28
                                                                                                    Function 0042E731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,0042BEF4,?,?), ref: 0042E754
                                                                                                    • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0042BEF4,?,?,00000000,?), ref: 0042E76B
                                                                                                    • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0042BEF4,?,?,00000000,?), ref: 0042E776
                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,0042BEF4,?,?,00000000,?), ref: 0042E783
                                                                                                    • GlobalLock.KERNEL32(00000000), ref: 0042E78C
                                                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,0042BEF4,?,?,00000000,?), ref: 0042E79B
                                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 0042E7A4
                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,0042BEF4,?,?,00000000,?), ref: 0042E7AB
                                                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0042BEF4,?,?,00000000,?), ref: 0042E7BC
                                                                                                    • OleLoadPicture.OLEAUT32(?,00000000,00000000,0044D9BC,?), ref: 0042E7D5
                                                                                                    • GlobalFree.KERNEL32(00000000), ref: 0042E7E5
                                                                                                    • GetObjectW.GDI32(00000000,00000018,?), ref: 0042E809
                                                                                                    • CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0042E834
                                                                                                    • DeleteObject.GDI32(00000000), ref: 0042E85C
                                                                                                    • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0042E872
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                    • String ID:
                                                                                                    • API String ID: 3840717409-0
                                                                                                    • Opcode ID: 61186ccee0f1e4c037e68f5a8c56162119ee34fdbb12ab4d607ce5340b60c9f1
                                                                                                    • Instruction ID: c6f930c20f2ca3482f49552f947ce26a765715e76674082cbd1ee89ae4d0b34e
                                                                                                    • Opcode Fuzzy Hash: 61186ccee0f1e4c037e68f5a8c56162119ee34fdbb12ab4d607ce5340b60c9f1
                                                                                                    • Instruction Fuzzy Hash: 0C414979A00214EFDB119F65DC48EAB7BB8FF8AB15F104069F906D72A0C7749941DB24
                                                                                                    Function 004105F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __wsplitpath.LIBCMT ref: 0041076F
                                                                                                    • _wcscat.LIBCMT ref: 00410787
                                                                                                    • _wcscat.LIBCMT ref: 00410799
                                                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 004107AE
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 004107C2
                                                                                                    • GetFileAttributesW.KERNEL32(?), ref: 004107DA
                                                                                                    • SetFileAttributesW.KERNEL32(?,00000000), ref: 004107F4
                                                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00410806
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                                                                    • String ID: *.*
                                                                                                    • API String ID: 34673085-438819550
                                                                                                    • Opcode ID: ad99b2c2ebe2b60b565dd9beaed92e4ea1b0ea7d62b2e2ecd33122b78412e0db
                                                                                                    • Instruction ID: ca7bf744bbbb25305ef9a233d8f6c847947796aec9d57c6abb06fcde3521117e
                                                                                                    • Opcode Fuzzy Hash: ad99b2c2ebe2b60b565dd9beaed92e4ea1b0ea7d62b2e2ecd33122b78412e0db
                                                                                                    • Instruction Fuzzy Hash: 02817F716043419FCB24EF24C8459AFB3E8BB99304F14482FF885DB250EAB8DDD58B56
                                                                                                    Function 0042EEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DB34E: GetWindowLongW.USER32(?,000000EB), ref: 003DB35F
                                                                                                    • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0042EF3B
                                                                                                    • GetFocus.USER32 ref: 0042EF4B
                                                                                                    • GetDlgCtrlID.USER32(00000000), ref: 0042EF56
                                                                                                    • _memset.LIBCMT ref: 0042F081
                                                                                                    • GetMenuItemInfoW.USER32 ref: 0042F0AC
                                                                                                    • GetMenuItemCount.USER32(00000000), ref: 0042F0CC
                                                                                                    • GetMenuItemID.USER32(?,00000000), ref: 0042F0DF
                                                                                                    • GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 0042F113
                                                                                                    • GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 0042F15B
                                                                                                    • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0042F193
                                                                                                    • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0042F1C8
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                                                                    • String ID: 0
                                                                                                    • API String ID: 1296962147-4108050209
                                                                                                    • Opcode ID: f992f37a137b63262b18d45fd7553c68c2ce9bfff5ae05a46ce8fbf40966830f
                                                                                                    • Instruction ID: fa241c4917a231b1d56e74f1f9e99aba4ff57674822a91c122bbfe1e7a96f189
                                                                                                    • Opcode Fuzzy Hash: f992f37a137b63262b18d45fd7553c68c2ce9bfff5ae05a46ce8fbf40966830f
                                                                                                    • Instruction Fuzzy Hash: 62817971604321AFD710CF15E884A6BBBE8FB88314F80493EF99897291D774DD15CB9A
                                                                                                    Function 003FA867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003FABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 003FABD7
                                                                                                      • Part of subcall function 003FABBB: GetLastError.KERNEL32(?,003FA69F,?,?,?), ref: 003FABE1
                                                                                                      • Part of subcall function 003FABBB: GetProcessHeap.KERNEL32(00000008,?,?,003FA69F,?,?,?), ref: 003FABF0
                                                                                                      • Part of subcall function 003FABBB: HeapAlloc.KERNEL32(00000000,?,003FA69F,?,?,?), ref: 003FABF7
                                                                                                      • Part of subcall function 003FABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 003FAC0E
                                                                                                      • Part of subcall function 003FAC56: GetProcessHeap.KERNEL32(00000008,003FA6B5,00000000,00000000,?,003FA6B5,?), ref: 003FAC62
                                                                                                      • Part of subcall function 003FAC56: HeapAlloc.KERNEL32(00000000,?,003FA6B5,?), ref: 003FAC69
                                                                                                      • Part of subcall function 003FAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,003FA6B5,?), ref: 003FAC7A
                                                                                                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 003FA8CB
                                                                                                    • _memset.LIBCMT ref: 003FA8E0
                                                                                                    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 003FA8FF
                                                                                                    • GetLengthSid.ADVAPI32(?), ref: 003FA910
                                                                                                    • GetAce.ADVAPI32(?,00000000,?), ref: 003FA94D
                                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003FA969
                                                                                                    • GetLengthSid.ADVAPI32(?), ref: 003FA986
                                                                                                    • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 003FA995
                                                                                                    • HeapAlloc.KERNEL32(00000000), ref: 003FA99C
                                                                                                    • GetLengthSid.ADVAPI32(?,00000008,?), ref: 003FA9BD
                                                                                                    • CopySid.ADVAPI32(00000000), ref: 003FA9C4
                                                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 003FA9F5
                                                                                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 003FAA1B
                                                                                                    • SetUserObjectSecurity.USER32(?,00000004,?), ref: 003FAA2F
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 3996160137-0
                                                                                                    • Opcode ID: aba887e68f92a927a0564fd38035065b362fee890b49eb938bb68263d5220d90
                                                                                                    • Instruction ID: bd05b03d3c77eeebc36ff86943ed1fd5b8153ea6ddcf28ea902588b2cdf24326
                                                                                                    • Opcode Fuzzy Hash: aba887e68f92a927a0564fd38035065b362fee890b49eb938bb68263d5220d90
                                                                                                    • Instruction Fuzzy Hash: C0513AB590060DABDF12DF90DD45AFEBBB9BF05304F048129EA19AB290DB359A05CB61
                                                                                                    Function 0040CC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: LoadString__swprintf_wprintf
                                                                                                    • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                    • API String ID: 2889450990-2391861430
                                                                                                    • Opcode ID: daf08f2570215ab0f27a78197e2c83d27c5fbae8de27b836a55f6bbca65eae19
                                                                                                    • Instruction ID: 36e3febe871250bd22b88826b3d234e33c979b142f549c4c617e372144497ff7
                                                                                                    • Opcode Fuzzy Hash: daf08f2570215ab0f27a78197e2c83d27c5fbae8de27b836a55f6bbca65eae19
                                                                                                    • Instruction Fuzzy Hash: 1F519172800109BACF16EBE0CD86FEEB778AF05300F10416AF505B61A2EB756F59DB65
                                                                                                    Function 0040CA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: LoadString__swprintf_wprintf
                                                                                                    • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                    • API String ID: 2889450990-3420473620
                                                                                                    • Opcode ID: 0102886184647e52b81aa0d4e2a97bcec759031dcc6c00a0c900ff1ad1de4439
                                                                                                    • Instruction ID: ea3baa33d29ba55bd39f92e07b5610b6ef9327ac2610bc1c0169b1c43b6a114a
                                                                                                    • Opcode Fuzzy Hash: 0102886184647e52b81aa0d4e2a97bcec759031dcc6c00a0c900ff1ad1de4439
                                                                                                    • Instruction Fuzzy Hash: 3C51A572800109AADF16FBE0DD46FEEB778AF04300F10416AF509B60A2DB786F59DB55
                                                                                                    Function 00423C06 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00422BB5,?,?), ref: 00423C1D
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: BuffCharUpper
                                                                                                    • String ID: $EG$HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                                                    • API String ID: 3964851224-800328521
                                                                                                    • Opcode ID: bfe17d3642b572d9eb3dc8a915e4a78613faf8fe4b7da51b809a47315766371b
                                                                                                    • Instruction ID: aaca30b56c10a9c09f301fddccdd6b85e15d85e407a9f735ce4b290d97c9160a
                                                                                                    • Opcode Fuzzy Hash: bfe17d3642b572d9eb3dc8a915e4a78613faf8fe4b7da51b809a47315766371b
                                                                                                    • Instruction Fuzzy Hash: EA41513122025A9BDF01EF10F851AEB3775AF52341F90881AED555F3A2EB7C9E0ACB14
                                                                                                    Function 004055BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 004055D7
                                                                                                    • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00405664
                                                                                                    • GetMenuItemCount.USER32(00481708), ref: 004056ED
                                                                                                    • DeleteMenu.USER32(00481708,00000005,00000000,000000F5,?,?), ref: 0040577D
                                                                                                    • DeleteMenu.USER32(00481708,00000004,00000000), ref: 00405785
                                                                                                    • DeleteMenu.USER32(00481708,00000006,00000000), ref: 0040578D
                                                                                                    • DeleteMenu.USER32(00481708,00000003,00000000), ref: 00405795
                                                                                                    • GetMenuItemCount.USER32(00481708), ref: 0040579D
                                                                                                    • SetMenuItemInfoW.USER32(00481708,00000004,00000000,00000030), ref: 004057D3
                                                                                                    • GetCursorPos.USER32(?), ref: 004057DD
                                                                                                    • SetForegroundWindow.USER32(00000000), ref: 004057E6
                                                                                                    • TrackPopupMenuEx.USER32(00481708,00000000,?,00000000,00000000,00000000), ref: 004057F9
                                                                                                    • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00405805
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 3993528054-0
                                                                                                    • Opcode ID: 3632965dac850b6a7f0ff28f2bf1431f2e0b9cda8c7a4c65612f1f9d33d4d715
                                                                                                    • Instruction ID: 96ef5dda55ea97072d1928acbca220236319339fcfc63982fe7721f9d8ea6428
                                                                                                    • Opcode Fuzzy Hash: 3632965dac850b6a7f0ff28f2bf1431f2e0b9cda8c7a4c65612f1f9d33d4d715
                                                                                                    • Instruction Fuzzy Hash: D4711470640605BEEB209B15CC49FABBF68FF40368F240227F6197A2D1CB7A5850DF58
                                                                                                    Function 003FA14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 003FA1DC
                                                                                                    • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 003FA211
                                                                                                    • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 003FA22D
                                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 003FA249
                                                                                                    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 003FA273
                                                                                                    • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 003FA29B
                                                                                                    • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 003FA2A6
                                                                                                    • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 003FA2AB
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
                                                                                                    • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                    • API String ID: 1687751970-22481851
                                                                                                    • Opcode ID: a3d526c2e01999b77c1cc921ce1ad744b860181dde674f9fdba37bcaf9dd5a8a
                                                                                                    • Instruction ID: 4526121985160b086de7f92e4c092b712b50f65da63f3e58b83e498242636264
                                                                                                    • Opcode Fuzzy Hash: a3d526c2e01999b77c1cc921ce1ad744b860181dde674f9fdba37bcaf9dd5a8a
                                                                                                    • Instruction Fuzzy Hash: 16410576C1022DAACF22EFA4DC85EEDB7B8FF08300F054129F905A7160EA749E05CB50
                                                                                                    Function 004067E9 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __swprintf.LIBCMT ref: 004067FD
                                                                                                    • __swprintf.LIBCMT ref: 0040680A
                                                                                                      • Part of subcall function 003E172B: __woutput_l.LIBCMT ref: 003E1784
                                                                                                    • FindResourceW.KERNEL32(?,?,0000000E), ref: 00406834
                                                                                                    • LoadResource.KERNEL32(?,00000000), ref: 00406840
                                                                                                    • LockResource.KERNEL32(00000000), ref: 0040684D
                                                                                                    • FindResourceW.KERNEL32(?,?,00000003), ref: 0040686D
                                                                                                    • LoadResource.KERNEL32(?,00000000), ref: 0040687F
                                                                                                    • SizeofResource.KERNEL32(?,00000000), ref: 0040688E
                                                                                                    • LockResource.KERNEL32(?), ref: 0040689A
                                                                                                    • CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 004068F9
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
                                                                                                    • String ID: 5G
                                                                                                    • API String ID: 1433390588-2931327513
                                                                                                    • Opcode ID: 502d8113793b26fcfc60307048d87161d189c71dc1eadac903b2b09e7979287b
                                                                                                    • Instruction ID: cf83d34a63b69dc757a62f04aa1c97ed828a2d0910a4b3a088124c7b53c16fe4
                                                                                                    • Opcode Fuzzy Hash: 502d8113793b26fcfc60307048d87161d189c71dc1eadac903b2b09e7979287b
                                                                                                    • Instruction Fuzzy Hash: 7831B57690121AABDB01AF60DD44EBF7BACFF09341F008836F902E6190E778D921D768
                                                                                                    Function 004025B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,004336F4,00000010,?,Bad directive syntax error,0045DC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 004025D6
                                                                                                    • LoadStringW.USER32(00000000,?,004336F4,00000010), ref: 004025DD
                                                                                                    • _wprintf.LIBCMT ref: 00402610
                                                                                                    • __swprintf.LIBCMT ref: 00402632
                                                                                                    • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 004026A1
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: HandleLoadMessageModuleString__swprintf_wprintf
                                                                                                    • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                                                    • API String ID: 1080873982-4153970271
                                                                                                    • Opcode ID: 8477d1dd4d947354620892e40d99148efee42333fdcd4edbc03167e66a6ac99b
                                                                                                    • Instruction ID: 1064d5df377a07b5f29dc183906020f7349bce46cb031b4148f54b5d8355aedb
                                                                                                    • Opcode Fuzzy Hash: 8477d1dd4d947354620892e40d99148efee42333fdcd4edbc03167e66a6ac99b
                                                                                                    • Instruction Fuzzy Hash: 8D21533180021ABFCF12AF90CC4AFEE7739BF19304F04446AF5056A0E3DA75AA55DB55
                                                                                                    Function 00407AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00407B42
                                                                                                    • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00407B58
                                                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00407B69
                                                                                                    • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00407B7B
                                                                                                    • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00407B8C
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: SendString
                                                                                                    • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                                                    • API String ID: 890592661-1007645807
                                                                                                    • Opcode ID: afcaed29a0b5d6bb0ef7a171a0a879b49425405f1dbf8bff2fa79900b0ce3371
                                                                                                    • Instruction ID: 8007424821aaf3f45225abb353c60fd7ebb0929c60b68b638c6f77bf08c8a8a0
                                                                                                    • Opcode Fuzzy Hash: afcaed29a0b5d6bb0ef7a171a0a879b49425405f1dbf8bff2fa79900b0ce3371
                                                                                                    • Instruction Fuzzy Hash: 661104B1A5026979D724BBA1CC4AFFFBA7CEB91B00F10442EB415B60C0DE786E45C6B5
                                                                                                    Function 0040778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • timeGetTime.WINMM ref: 00407794
                                                                                                      • Part of subcall function 003DDC38: timeGetTime.WINMM(?,75A4B400,004358AB), ref: 003DDC3C
                                                                                                    • Sleep.KERNEL32(0000000A), ref: 004077C0
                                                                                                    • EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 004077E4
                                                                                                    • FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00407806
                                                                                                    • SetActiveWindow.USER32 ref: 00407825
                                                                                                    • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00407833
                                                                                                    • SendMessageW.USER32(00000010,00000000,00000000), ref: 00407852
                                                                                                    • Sleep.KERNEL32(000000FA), ref: 0040785D
                                                                                                    • IsWindow.USER32 ref: 00407869
                                                                                                    • EndDialog.USER32(00000000), ref: 0040787A
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                                                    • String ID: BUTTON
                                                                                                    • API String ID: 1194449130-3405671355
                                                                                                    • Opcode ID: 334753da00ec8f2b2952ff14e227916bfbdd2c75f762fb2a80286bfda6136feb
                                                                                                    • Instruction ID: 321b6966dd69d60a0965b2493853b6ddfbe36567fa4b1edf84f17813e159145e
                                                                                                    • Opcode Fuzzy Hash: 334753da00ec8f2b2952ff14e227916bfbdd2c75f762fb2a80286bfda6136feb
                                                                                                    • Instruction Fuzzy Hash: 7D218475A04205BFE7116F60EC89B2A3F29FB4578AF00443AF905922A1CF796C05DB2E
                                                                                                    Function 004102EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C936C: __swprintf.LIBCMT ref: 003C93AB
                                                                                                      • Part of subcall function 003C936C: __itow.LIBCMT ref: 003C93DF
                                                                                                    • CoInitialize.OLE32(00000000), ref: 0041034B
                                                                                                    • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 004103DE
                                                                                                    • SHGetDesktopFolder.SHELL32(?), ref: 004103F2
                                                                                                    • CoCreateInstance.OLE32(0044DA8C,00000000,00000001,00473CF8,?), ref: 0041043E
                                                                                                    • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 004104AD
                                                                                                    • CoTaskMemFree.OLE32(?,?), ref: 00410505
                                                                                                    • _memset.LIBCMT ref: 00410542
                                                                                                    • SHBrowseForFolderW.SHELL32(?), ref: 0041057E
                                                                                                    • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 004105A1
                                                                                                    • CoTaskMemFree.OLE32(00000000), ref: 004105A8
                                                                                                    • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 004105DF
                                                                                                    • CoUninitialize.OLE32(00000001,00000000), ref: 004105E1
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 1246142700-0
                                                                                                    • Opcode ID: d00354b55c1b5f8f2de9b9641a15d981b744d875420a318ef953fe0ea3b4afff
                                                                                                    • Instruction ID: 1fafc060a6712475f7283385e6743e5e56b9ded7dc868e12c3ad1c01dc6e433d
                                                                                                    • Opcode Fuzzy Hash: d00354b55c1b5f8f2de9b9641a15d981b744d875420a318ef953fe0ea3b4afff
                                                                                                    • Instruction Fuzzy Hash: 3BB1FD75A00109AFDB05DFA4C888EAEBBB9FF49304B14846AF815EB251DB74ED81CF54
                                                                                                    Function 00402E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetKeyboardState.USER32(?), ref: 00402ED6
                                                                                                    • SetKeyboardState.USER32(?), ref: 00402F41
                                                                                                    • GetAsyncKeyState.USER32(000000A0), ref: 00402F61
                                                                                                    • GetKeyState.USER32(000000A0), ref: 00402F78
                                                                                                    • GetAsyncKeyState.USER32(000000A1), ref: 00402FA7
                                                                                                    • GetKeyState.USER32(000000A1), ref: 00402FB8
                                                                                                    • GetAsyncKeyState.USER32(00000011), ref: 00402FE4
                                                                                                    • GetKeyState.USER32(00000011), ref: 00402FF2
                                                                                                    • GetAsyncKeyState.USER32(00000012), ref: 0040301B
                                                                                                    • GetKeyState.USER32(00000012), ref: 00403029
                                                                                                    • GetAsyncKeyState.USER32(0000005B), ref: 00403052
                                                                                                    • GetKeyState.USER32(0000005B), ref: 00403060
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: State$Async$Keyboard
                                                                                                    • String ID:
                                                                                                    • API String ID: 541375521-0
                                                                                                    • Opcode ID: 048c58882203f113362d7f5fe14fb63ee4bbce67b7e3ff4ab18465c887f231cd
                                                                                                    • Instruction ID: e57996694bcc95d05a7dccf1a7783e07dee68df08c6ec73e40631fec3098baa6
                                                                                                    • Opcode Fuzzy Hash: 048c58882203f113362d7f5fe14fb63ee4bbce67b7e3ff4ab18465c887f231cd
                                                                                                    • Instruction Fuzzy Hash: 6A51D960A0478429FB35DB7489147ABBFB45F11384F0845AFC5C26A2C2DABC9B4CC7A9
                                                                                                    Function 003FED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetDlgItem.USER32(?,00000001), ref: 003FED1E
                                                                                                    • GetWindowRect.USER32(00000000,?), ref: 003FED30
                                                                                                    • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 003FED8E
                                                                                                    • GetDlgItem.USER32(?,00000002), ref: 003FED99
                                                                                                    • GetWindowRect.USER32(00000000,?), ref: 003FEDAB
                                                                                                    • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 003FEE01
                                                                                                    • GetDlgItem.USER32(?,000003E9), ref: 003FEE0F
                                                                                                    • GetWindowRect.USER32(00000000,?), ref: 003FEE20
                                                                                                    • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 003FEE63
                                                                                                    • GetDlgItem.USER32(?,000003EA), ref: 003FEE71
                                                                                                    • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 003FEE8E
                                                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 003FEE9B
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$ItemMoveRect$Invalidate
                                                                                                    • String ID:
                                                                                                    • API String ID: 3096461208-0
                                                                                                    • Opcode ID: c5c56c77275994a98306cc22c8a154652deca6f212c3b0166d9a6f9e14bbffb5
                                                                                                    • Instruction ID: 6be997ad21e97b609956fcbfb1e50d9881f9819b6db95f2eb0d7dfd34e5c769b
                                                                                                    • Opcode Fuzzy Hash: c5c56c77275994a98306cc22c8a154652deca6f212c3b0166d9a6f9e14bbffb5
                                                                                                    • Instruction Fuzzy Hash: 4C512075B00209AFDB19CF69DD85AAEBBBAFB89700F158139F619D7290D7709D00CB14
                                                                                                    Function 003DB73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,003DB759,?,00000000,?,?,?,?,003DB72B,00000000,?), ref: 003DBA58
                                                                                                    • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,003DB72B), ref: 003DB7F6
                                                                                                    • KillTimer.USER32(00000000,?,00000000,?,?,?,?,003DB72B,00000000,?,?,003DB2EF,?,?), ref: 003DB88D
                                                                                                    • DestroyAcceleratorTable.USER32(00000000), ref: 0043D8A6
                                                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,003DB72B,00000000,?,?,003DB2EF,?,?), ref: 0043D8D7
                                                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,003DB72B,00000000,?,?,003DB2EF,?,?), ref: 0043D8EE
                                                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,003DB72B,00000000,?,?,003DB2EF,?,?), ref: 0043D90A
                                                                                                    • DeleteObject.GDI32(00000000), ref: 0043D91C
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 641708696-0
                                                                                                    • Opcode ID: 73eca09034f0190761909229188e514d8cd516bc2eb518e28a5f568c4daf3118
                                                                                                    • Instruction ID: c9232573e90ef0836b6ea1d870ecf9ed5039390f9915d24863272990fd8991cd
                                                                                                    • Opcode Fuzzy Hash: 73eca09034f0190761909229188e514d8cd516bc2eb518e28a5f568c4daf3118
                                                                                                    • Instruction Fuzzy Hash: 0C619E32901600DFDB269F14E888B2AF7B9FF95315F16552FE08696B70D734A881DF48
                                                                                                    Function 003DB40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DB526: GetWindowLongW.USER32(?,000000EB), ref: 003DB537
                                                                                                    • GetSysColor.USER32(0000000F), ref: 003DB438
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ColorLongWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 259745315-0
                                                                                                    • Opcode ID: cfd8ba0b1d92ee678868c8418fbe42445e7ea13e65af715ef8cf185e19324b71
                                                                                                    • Instruction ID: 3797a9b0f7c05f8e3c1cb7ed695b5484271eeafa943b530b38b188caf36f76f3
                                                                                                    • Opcode Fuzzy Hash: cfd8ba0b1d92ee678868c8418fbe42445e7ea13e65af715ef8cf185e19324b71
                                                                                                    • Instruction Fuzzy Hash: CE41F636400100EFDF269F29EC89BBA7B75AB0A331F564262FD658E2E6D7308C41C725
                                                                                                    Function 0040690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                                                    • String ID:
                                                                                                    • API String ID: 136442275-0
                                                                                                    • Opcode ID: 7a49908adc6475b4b92b6569c83161b142e298faf040ad09bc89872b0809af93
                                                                                                    • Instruction ID: 86548f8472b33ec4c91017a3085d790a6488add8ee2d411f0eba3800b1fe0a66
                                                                                                    • Opcode Fuzzy Hash: 7a49908adc6475b4b92b6569c83161b142e298faf040ad09bc89872b0809af93
                                                                                                    • Instruction Fuzzy Hash: 3A415E7684512CAECF66EB91CC41DCB73BCEB44300F1042E7B649B6081EA74ABE88F54
                                                                                                    Function 0040D76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CharLowerBuffW.USER32(0045DC00,0045DC00,0045DC00), ref: 0040D7CE
                                                                                                    • GetDriveTypeW.KERNEL32(?,00473A70,00000061), ref: 0040D898
                                                                                                    • _wcscpy.LIBCMT ref: 0040D8C2
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: BuffCharDriveLowerType_wcscpy
                                                                                                    • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                                                    • API String ID: 2820617543-1000479233
                                                                                                    • Opcode ID: b79471c2acc8f0a79688282d5c29e62ebc121b2b6ae572c46004247c4fa12885
                                                                                                    • Instruction ID: 9c6282052adcebbee0906377cdb43abfbd5088ebda7497b60c17957cf0747f13
                                                                                                    • Opcode Fuzzy Hash: b79471c2acc8f0a79688282d5c29e62ebc121b2b6ae572c46004247c4fa12885
                                                                                                    • Instruction Fuzzy Hash: 3F5183365142009FC701FF54D892AABB7A5EF84314F10C82EF4A96B2E2DB35DE09CB46
                                                                                                    Function 003C936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __swprintf.LIBCMT ref: 003C93AB
                                                                                                    • __itow.LIBCMT ref: 003C93DF
                                                                                                      • Part of subcall function 003E1557: _xtow@16.LIBCMT ref: 003E1578
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __itow__swprintf_xtow@16
                                                                                                    • String ID: %.15g$0x%p$False$True
                                                                                                    • API String ID: 1502193981-2263619337
                                                                                                    • Opcode ID: bcd9bfa063d0b74739008d8230a1e0375b7624ef51122926978d391a6ec40626
                                                                                                    • Instruction ID: ea9a7238da7f6f3d88c90024a683adb094b7040336200ef8d4f2d7c3c0069fd1
                                                                                                    • Opcode Fuzzy Hash: bcd9bfa063d0b74739008d8230a1e0375b7624ef51122926978d391a6ec40626
                                                                                                    • Instruction Fuzzy Hash: A141E476504204AFDB25EF74D945FAAB3E8EF88300F21546FE14ADB2C1EA35AD41CB15
                                                                                                    Function 0042A1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0042A259
                                                                                                    • CreateCompatibleDC.GDI32(00000000), ref: 0042A260
                                                                                                    • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 0042A273
                                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 0042A27B
                                                                                                    • GetPixel.GDI32(00000000,00000000,00000000), ref: 0042A286
                                                                                                    • DeleteDC.GDI32(00000000), ref: 0042A28F
                                                                                                    • GetWindowLongW.USER32(?,000000EC), ref: 0042A299
                                                                                                    • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 0042A2AD
                                                                                                    • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0042A2B9
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                                                    • String ID: static
                                                                                                    • API String ID: 2559357485-2160076837
                                                                                                    • Opcode ID: 43a221b668607b3a56f4e0337f2dc5b4ebe86a4c302cf9c8f454c779c2f5e931
                                                                                                    • Instruction ID: 8a1b74207a37c08c42eedbec111d2ce8416a373ec3f6ce60cb09a1902f2747da
                                                                                                    • Opcode Fuzzy Hash: 43a221b668607b3a56f4e0337f2dc5b4ebe86a4c302cf9c8f454c779c2f5e931
                                                                                                    • Instruction Fuzzy Hash: 68316035600125EBDF115FA4EC49FDB3B69FF0E364F110225FA19A62A0C735D821DB69
                                                                                                    Function 00406F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                                                    • String ID: 0.0.0.0
                                                                                                    • API String ID: 2620052-3771769585
                                                                                                    • Opcode ID: e2123204b9e5c1e78bac00671abf3c50afa95fcff95802fcbf42f63c8ea99c17
                                                                                                    • Instruction ID: 271c03fe290ddf9979796ebed73cd641d2938d426636c883c2b55b8ae34bac1f
                                                                                                    • Opcode Fuzzy Hash: e2123204b9e5c1e78bac00671abf3c50afa95fcff95802fcbf42f63c8ea99c17
                                                                                                    • Instruction Fuzzy Hash: 1B113A32904115AFCB25AB71AC49EDB77ACDF41710F010176F006B61C1EFB8DA818758
                                                                                                    Function 003E500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 003E5047
                                                                                                      • Part of subcall function 003E7C0E: __getptd_noexit.LIBCMT ref: 003E7C0E
                                                                                                    • __gmtime64_s.LIBCMT ref: 003E50E0
                                                                                                    • __gmtime64_s.LIBCMT ref: 003E5116
                                                                                                    • __gmtime64_s.LIBCMT ref: 003E5133
                                                                                                    • __allrem.LIBCMT ref: 003E5189
                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003E51A5
                                                                                                    • __allrem.LIBCMT ref: 003E51BC
                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003E51DA
                                                                                                    • __allrem.LIBCMT ref: 003E51F1
                                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003E520F
                                                                                                    • __invoke_watson.LIBCMT ref: 003E5280
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 384356119-0
                                                                                                    • Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                                                                    • Instruction ID: 2910dd4e38bff9c4f9e1bd7b5bd52eb6e8f95cbafedbce1ac09feea63d052be7
                                                                                                    • Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                                                                    • Instruction Fuzzy Hash: 7B71FA71A01B6BABD7169E7ACC41B6A73A8BF10368F154729F510DB6C1E770ED4087D0
                                                                                                    Function 00404DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 00404DF8
                                                                                                    • GetMenuItemInfoW.USER32(00481708,000000FF,00000000,00000030), ref: 00404E59
                                                                                                    • SetMenuItemInfoW.USER32(00481708,00000004,00000000,00000030), ref: 00404E8F
                                                                                                    • Sleep.KERNEL32(000001F4), ref: 00404EA1
                                                                                                    • GetMenuItemCount.USER32(?), ref: 00404EE5
                                                                                                    • GetMenuItemID.USER32(?,00000000), ref: 00404F01
                                                                                                    • GetMenuItemID.USER32(?,-00000001), ref: 00404F2B
                                                                                                    • GetMenuItemID.USER32(?,?), ref: 00404F70
                                                                                                    • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00404FB6
                                                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00404FCA
                                                                                                    • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00404FEB
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 4176008265-0
                                                                                                    • Opcode ID: de124aa293e3158b528368349f2d5520c55b56ea5e564b832422363f86c9afa4
                                                                                                    • Instruction ID: b795a3db1b92e14116dda8a97f5b8182b2c8f437d5df8ec12894bf7799ff9c0e
                                                                                                    • Opcode Fuzzy Hash: de124aa293e3158b528368349f2d5520c55b56ea5e564b832422363f86c9afa4
                                                                                                    • Instruction Fuzzy Hash: 636192B5900249EFDB11CFA4DC849AF7BB8EF81308F14046AFA41B7291D738AD45DB69
                                                                                                    Function 00429C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00429C98
                                                                                                    • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00429C9B
                                                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 00429CBF
                                                                                                    • _memset.LIBCMT ref: 00429CD0
                                                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00429CE2
                                                                                                    • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00429D5A
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$LongWindow_memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 830647256-0
                                                                                                    • Opcode ID: 80166516a587eecaf19df903a5714ea6831f3a2a5d05c85d2638a038b94e707f
                                                                                                    • Instruction ID: 7b33130ae76c369c4642cfc181458102d7afa318466c096a9b6adeb91487086f
                                                                                                    • Opcode Fuzzy Hash: 80166516a587eecaf19df903a5714ea6831f3a2a5d05c85d2638a038b94e707f
                                                                                                    • Instruction Fuzzy Hash: B5619E75A00218AFDB11DFA4DC81EEEB7B8EF09704F14416AFA04E72A1D774AD42DB58
                                                                                                    Function 003F94E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 003F94FE
                                                                                                    • SafeArrayAllocData.OLEAUT32(?), ref: 003F9549
                                                                                                    • VariantInit.OLEAUT32(?), ref: 003F955B
                                                                                                    • SafeArrayAccessData.OLEAUT32(?,?), ref: 003F957B
                                                                                                    • VariantCopy.OLEAUT32(?,?), ref: 003F95BE
                                                                                                    • SafeArrayUnaccessData.OLEAUT32(?), ref: 003F95D2
                                                                                                    • VariantClear.OLEAUT32(?), ref: 003F95E7
                                                                                                    • SafeArrayDestroyData.OLEAUT32(?), ref: 003F95F4
                                                                                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003F95FD
                                                                                                    • VariantClear.OLEAUT32(?), ref: 003F960F
                                                                                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003F961A
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                                                    • String ID:
                                                                                                    • API String ID: 2706829360-0
                                                                                                    • Opcode ID: e3cc52e95930651fd21f315fdf546bbcb28ae83ab74787f8a56ac8481b0136f9
                                                                                                    • Instruction ID: d6f63f408af3f027fea85810a5b89a55e8fac19a201759827d397c52a2045904
                                                                                                    • Opcode Fuzzy Hash: e3cc52e95930651fd21f315fdf546bbcb28ae83ab74787f8a56ac8481b0136f9
                                                                                                    • Instruction Fuzzy Hash: 15412D35E00219AFCB02DFA4D848AEEBB79FF09354F008066E515E7261DB34EA45CBA5
                                                                                                    Function 0041BB08 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 264COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Variant$ClearInit$_memset
                                                                                                    • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$h?G$|?G
                                                                                                    • API String ID: 2862541840-1126824058
                                                                                                    • Opcode ID: 8b5280240a52352d17a4695ce6694b0c4131e6624cb1e2cbc0411e5bf60c00e7
                                                                                                    • Instruction ID: 64249e5c44cc20c92030f252eb3032b307863cb42c1291dce92abc3ac006ee75
                                                                                                    • Opcode Fuzzy Hash: 8b5280240a52352d17a4695ce6694b0c4131e6624cb1e2cbc0411e5bf60c00e7
                                                                                                    • Instruction Fuzzy Hash: C2919071A00215ABDF24CFA5D844FEFB7B8EF85714F10815AF505AB290DB789981CBE8
                                                                                                    Function 0041ADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C936C: __swprintf.LIBCMT ref: 003C93AB
                                                                                                      • Part of subcall function 003C936C: __itow.LIBCMT ref: 003C93DF
                                                                                                    • CoInitialize.OLE32 ref: 0041ADF6
                                                                                                    • CoUninitialize.OLE32 ref: 0041AE01
                                                                                                    • CoCreateInstance.OLE32(?,00000000,00000017,0044D8FC,?), ref: 0041AE61
                                                                                                    • IIDFromString.OLE32(?,?), ref: 0041AED4
                                                                                                    • VariantInit.OLEAUT32(?), ref: 0041AF6E
                                                                                                    • VariantClear.OLEAUT32(?), ref: 0041AFCF
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                                                                    • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                                                    • API String ID: 834269672-1287834457
                                                                                                    • Opcode ID: 88f5ddf6cd65b4111279802920abe416fe8d851690ade344c6f1441458e631dd
                                                                                                    • Instruction ID: 154a99e8b139cb774168479fb5c878d01f935999666f248a8e94cc629c9a8e82
                                                                                                    • Opcode Fuzzy Hash: 88f5ddf6cd65b4111279802920abe416fe8d851690ade344c6f1441458e631dd
                                                                                                    • Instruction Fuzzy Hash: B861BE70609301AFC711DF64C848BABB7E8AF89714F10441EF9859B291C778ED99CB9B
                                                                                                    Function 00418107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • WSAStartup.WSOCK32(00000101,?), ref: 00418168
                                                                                                    • inet_addr.WSOCK32(?,?,?), ref: 004181AD
                                                                                                    • gethostbyname.WSOCK32(?), ref: 004181B9
                                                                                                    • IcmpCreateFile.IPHLPAPI ref: 004181C7
                                                                                                    • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00418237
                                                                                                    • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 0041824D
                                                                                                    • IcmpCloseHandle.IPHLPAPI(00000000), ref: 004182C2
                                                                                                    • WSACleanup.WSOCK32 ref: 004182C8
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                                                    • String ID: Ping
                                                                                                    • API String ID: 1028309954-2246546115
                                                                                                    • Opcode ID: f2d7d62ebbb43ba263a227cf394ed231462b69b5cd9f22bcdf9a44e0364c6fbe
                                                                                                    • Instruction ID: 50e974464c14754070542ec0017f7c2ed636e1cef6e112a30f26e7c670c4dc4c
                                                                                                    • Opcode Fuzzy Hash: f2d7d62ebbb43ba263a227cf394ed231462b69b5cd9f22bcdf9a44e0364c6fbe
                                                                                                    • Instruction Fuzzy Hash: 8751A136600600AFD712DF24DC85B6ABBE4AF49310F04896EF955DB3A0DB38ED41CB4A
                                                                                                    Function 0040E389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0040E396
                                                                                                    • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0040E40C
                                                                                                    • GetLastError.KERNEL32 ref: 0040E416
                                                                                                    • SetErrorMode.KERNEL32(00000000,READY), ref: 0040E483
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                    • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                    • API String ID: 4194297153-14809454
                                                                                                    • Opcode ID: 56d9e871b55c3032c11e0341c13c37772631742bdc5ef4937cac4288c2c5bd84
                                                                                                    • Instruction ID: 35951fff2262cdbc38174ac565609f292bef4ac1a7c62522b9aa6d437e98f191
                                                                                                    • Opcode Fuzzy Hash: 56d9e871b55c3032c11e0341c13c37772631742bdc5ef4937cac4288c2c5bd84
                                                                                                    • Instruction Fuzzy Hash: 18315036A002059FD701EF65C845FAEB7B4EB45304F14847BE505EB2D2DB789D12CB55
                                                                                                    Function 003FB907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 003FB98C
                                                                                                    • GetDlgCtrlID.USER32 ref: 003FB997
                                                                                                    • GetParent.USER32 ref: 003FB9B3
                                                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 003FB9B6
                                                                                                    • GetDlgCtrlID.USER32(?), ref: 003FB9BF
                                                                                                    • GetParent.USER32(?), ref: 003FB9DB
                                                                                                    • SendMessageW.USER32(00000000,?,?,00000111), ref: 003FB9DE
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$CtrlParent
                                                                                                    • String ID: ComboBox$ListBox
                                                                                                    • API String ID: 1383977212-1403004172
                                                                                                    • Opcode ID: 26736d5678c73eede4e9886de0a66586a2335cc4233c647e50a79f93cc6f717a
                                                                                                    • Instruction ID: 8bb5213ec24fda74fa030246cf21996c908ccf95ddf7e08351704e10a3a8bb23
                                                                                                    • Opcode Fuzzy Hash: 26736d5678c73eede4e9886de0a66586a2335cc4233c647e50a79f93cc6f717a
                                                                                                    • Instruction Fuzzy Hash: E921F8B4A00108BFCB05ABA0CC85FFEB779EF46300F104119F655972D1DBB95815DB24
                                                                                                    Function 003FB9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 003FBA73
                                                                                                    • GetDlgCtrlID.USER32 ref: 003FBA7E
                                                                                                    • GetParent.USER32 ref: 003FBA9A
                                                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 003FBA9D
                                                                                                    • GetDlgCtrlID.USER32(?), ref: 003FBAA6
                                                                                                    • GetParent.USER32(?), ref: 003FBAC2
                                                                                                    • SendMessageW.USER32(00000000,?,?,00000111), ref: 003FBAC5
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$CtrlParent
                                                                                                    • String ID: ComboBox$ListBox
                                                                                                    • API String ID: 1383977212-1403004172
                                                                                                    • Opcode ID: f99603bc1e5954558ab2ab77097cd57cdc5f8c3d9795ff57e25c1db6d6aa4dcd
                                                                                                    • Instruction ID: 76971f172a3b6c6d74ba2f4b46881aea95b2d1ec3e9d7d74eb7ba03843c9eb80
                                                                                                    • Opcode Fuzzy Hash: f99603bc1e5954558ab2ab77097cd57cdc5f8c3d9795ff57e25c1db6d6aa4dcd
                                                                                                    • Instruction Fuzzy Hash: 652195B4A40108BFDF02ABA4CC85FFEB779EF46300F144019F65597291DBB59915DB24
                                                                                                    Function 003FBAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetParent.USER32 ref: 003FBAE3
                                                                                                    • GetClassNameW.USER32(00000000,?,00000100), ref: 003FBAF8
                                                                                                    • _wcscmp.LIBCMT ref: 003FBB0A
                                                                                                    • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 003FBB85
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ClassMessageNameParentSend_wcscmp
                                                                                                    • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                    • API String ID: 1704125052-3381328864
                                                                                                    • Opcode ID: c2925c436b51fc6206a936ba610cca03b60e06ccf9a3906044d332036d12b61b
                                                                                                    • Instruction ID: be25acef5f342e2eab59db8f70e0d1fe13601cc9ab8fff21bc1ad17363f107f3
                                                                                                    • Opcode Fuzzy Hash: c2925c436b51fc6206a936ba610cca03b60e06ccf9a3906044d332036d12b61b
                                                                                                    • Instruction Fuzzy Hash: B8112CB6A0835BFAFA266631DC07DF6B79CDB11720B300122FA08E40D5FBE59C514518
                                                                                                    Function 0041B2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • VariantInit.OLEAUT32(?), ref: 0041B2D5
                                                                                                    • CoInitialize.OLE32(00000000), ref: 0041B302
                                                                                                    • CoUninitialize.OLE32 ref: 0041B30C
                                                                                                    • GetRunningObjectTable.OLE32(00000000,?), ref: 0041B40C
                                                                                                    • SetErrorMode.KERNEL32(00000001,00000029), ref: 0041B539
                                                                                                    • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 0041B56D
                                                                                                    • CoGetObject.OLE32(?,00000000,0044D91C,?), ref: 0041B590
                                                                                                    • SetErrorMode.KERNEL32(00000000), ref: 0041B5A3
                                                                                                    • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041B623
                                                                                                    • VariantClear.OLEAUT32(0044D91C), ref: 0041B633
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                                                                    • String ID:
                                                                                                    • API String ID: 2395222682-0
                                                                                                    • Opcode ID: 0adb89db9b4e7397d0907bd57c82570dfa319c9b7a9f7ec528d219dc50e33186
                                                                                                    • Instruction ID: 7a9be9aaf37276cb2b8e1c975b389c7f8173169d7290d94e28641a6c0dea85ef
                                                                                                    • Opcode Fuzzy Hash: 0adb89db9b4e7397d0907bd57c82570dfa319c9b7a9f7ec528d219dc50e33186
                                                                                                    • Instruction Fuzzy Hash: 1DC100B1608304AFC700DF64C884A6AB7E9FF89308F00495EF98ADB251DB75ED45CB96
                                                                                                    Function 003EACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __lock.LIBCMT ref: 003EACC1
                                                                                                      • Part of subcall function 003E7CF4: __mtinitlocknum.LIBCMT ref: 003E7D06
                                                                                                      • Part of subcall function 003E7CF4: EnterCriticalSection.KERNEL32(00000000,?,003E7ADD,0000000D), ref: 003E7D1F
                                                                                                    • __calloc_crt.LIBCMT ref: 003EACD2
                                                                                                      • Part of subcall function 003E6986: __calloc_impl.LIBCMT ref: 003E6995
                                                                                                      • Part of subcall function 003E6986: Sleep.KERNEL32(00000000,000003BC,003DF507,?,0000000E), ref: 003E69AC
                                                                                                    • @_EH4_CallFilterFunc@8.LIBCMT ref: 003EACED
                                                                                                    • GetStartupInfoW.KERNEL32(?,00476E28,00000064,003E5E91,00476C70,00000014), ref: 003EAD46
                                                                                                    • __calloc_crt.LIBCMT ref: 003EAD91
                                                                                                    • GetFileType.KERNEL32(00000001), ref: 003EADD8
                                                                                                    • InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 003EAE11
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
                                                                                                    • String ID:
                                                                                                    • API String ID: 1426640281-0
                                                                                                    • Opcode ID: 2bdd956ead463da5a91528ed50bde5a176cfad07091635604dfd7b8aab2818b5
                                                                                                    • Instruction ID: adc275c852fe46159a00b9309028a00145e2130fc0a2b7691f80b96bfbeb7e54
                                                                                                    • Opcode Fuzzy Hash: 2bdd956ead463da5a91528ed50bde5a176cfad07091635604dfd7b8aab2818b5
                                                                                                    • Instruction Fuzzy Hash: AC81F671905BA58FDB15CF69C8405AEBBF4AF45320B24436DD4A6AB3D1C734A803CB56
                                                                                                    Function 00404025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00404047
                                                                                                    • GetForegroundWindow.USER32(00000000,?,?,?,?,?,004030A5,?,00000001), ref: 0040405B
                                                                                                    • GetWindowThreadProcessId.USER32(00000000), ref: 00404062
                                                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,004030A5,?,00000001), ref: 00404071
                                                                                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00404083
                                                                                                    • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,004030A5,?,00000001), ref: 0040409C
                                                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,004030A5,?,00000001), ref: 004040AE
                                                                                                    • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,004030A5,?,00000001), ref: 004040F3
                                                                                                    • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,004030A5,?,00000001), ref: 00404108
                                                                                                    • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,004030A5,?,00000001), ref: 00404113
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                    • String ID:
                                                                                                    • API String ID: 2156557900-0
                                                                                                    • Opcode ID: f8390ad0bf5a3148513d5af43f3a124011661824afd73fab252d3de01ea4cb94
                                                                                                    • Instruction ID: a5075e418a981a8a74aa5537cacc5698a228471ea493117159a9576c31105cae
                                                                                                    • Opcode Fuzzy Hash: f8390ad0bf5a3148513d5af43f3a124011661824afd73fab252d3de01ea4cb94
                                                                                                    • Instruction Fuzzy Hash: E83184B6900204BBDB10DF54DC4AB6E77A9ABD5712F11853AFE05F62E0C7B899408B5C
                                                                                                    Function 0043DD4A Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetSysColor.USER32(00000008), ref: 003DB496
                                                                                                    • SetTextColor.GDI32(?,000000FF), ref: 003DB4A0
                                                                                                    • SetBkMode.GDI32(?,00000001), ref: 003DB4B5
                                                                                                    • GetStockObject.GDI32(00000005), ref: 003DB4BD
                                                                                                    • GetClientRect.USER32(?), ref: 0043DD63
                                                                                                    • SendMessageW.USER32(?,00001328,00000000,?), ref: 0043DD7A
                                                                                                    • GetWindowDC.USER32(?), ref: 0043DD86
                                                                                                    • GetPixel.GDI32(00000000,?,?), ref: 0043DD95
                                                                                                    • ReleaseDC.USER32(?,00000000), ref: 0043DDA7
                                                                                                    • GetSysColor.USER32(00000005), ref: 0043DDC5
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 3430376129-0
                                                                                                    • Opcode ID: 05ff5d5c77f8344440cf4d2e07cb284d394c2ccb6e138e417e65e8f19cb7cab5
                                                                                                    • Instruction ID: 315f2bbb00e6f376ac19802dd62e6d4f9d5d35ae7fbc32c81ee6dc0444c711db
                                                                                                    • Opcode Fuzzy Hash: 05ff5d5c77f8344440cf4d2e07cb284d394c2ccb6e138e417e65e8f19cb7cab5
                                                                                                    • Instruction Fuzzy Hash: 48115135900205FFDB126FA4EC09BE97B75EB0A325F118636FA66951E2CB310941DF15
                                                                                                    Function 003C3093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 003C30DC
                                                                                                    • CoUninitialize.OLE32(?,00000000), ref: 003C3181
                                                                                                    • UnregisterHotKey.USER32(?), ref: 003C32A9
                                                                                                    • DestroyWindow.USER32(?), ref: 00435079
                                                                                                    • FreeLibrary.KERNEL32(?), ref: 004350F8
                                                                                                    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00435125
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                                                    • String ID: close all
                                                                                                    • API String ID: 469580280-3243417748
                                                                                                    • Opcode ID: 9fc8870a0346ff5ae119632635517f2b4616ff290a7b2df97d5c1c74f44384d3
                                                                                                    • Instruction ID: 2bb51371b53dab96b0d9a53f7d4394b10ea70524410676324aa71dffc4bdb409
                                                                                                    • Opcode Fuzzy Hash: 9fc8870a0346ff5ae119632635517f2b4616ff290a7b2df97d5c1c74f44384d3
                                                                                                    • Instruction Fuzzy Hash: 9F9126746002028FC70AEF14C895F69F3B4BF09304F5492AEE40AAB262DF35AE56CF54
                                                                                                    Function 003DCB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SetWindowLongW.USER32(?,000000EB), ref: 003DCC15
                                                                                                      • Part of subcall function 003DCCCD: GetClientRect.USER32(?,?), ref: 003DCCF6
                                                                                                      • Part of subcall function 003DCCCD: GetWindowRect.USER32(?,?), ref: 003DCD37
                                                                                                      • Part of subcall function 003DCCCD: ScreenToClient.USER32(?,?), ref: 003DCD5F
                                                                                                    • GetDC.USER32 ref: 0043D137
                                                                                                    • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0043D14A
                                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 0043D158
                                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 0043D16D
                                                                                                    • ReleaseDC.USER32(?,00000000), ref: 0043D175
                                                                                                    • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0043D200
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                                                    • String ID: U
                                                                                                    • API String ID: 4009187628-3372436214
                                                                                                    • Opcode ID: 0580308a10ca5c562088c5f7af063c60703cfee06aa0ff3db3ba9d96654ba447
                                                                                                    • Instruction ID: b034e4462d879461ca089f15a19e7c1e1d829302319c14ef9e2fb85e1ba70c2f
                                                                                                    • Opcode Fuzzy Hash: 0580308a10ca5c562088c5f7af063c60703cfee06aa0ff3db3ba9d96654ba447
                                                                                                    • Instruction Fuzzy Hash: 93710031900205DFCF269F64E880AAA7BB9FF48314F18526BED555B3A6D7388C42DF58
                                                                                                    Function 0042ECD4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DB34E: GetWindowLongW.USER32(?,000000EB), ref: 003DB35F
                                                                                                      • Part of subcall function 003DB63C: GetCursorPos.USER32(000000FF), ref: 003DB64F
                                                                                                      • Part of subcall function 003DB63C: ScreenToClient.USER32(00000000,000000FF), ref: 003DB66C
                                                                                                      • Part of subcall function 003DB63C: GetAsyncKeyState.USER32(00000001), ref: 003DB691
                                                                                                      • Part of subcall function 003DB63C: GetAsyncKeyState.USER32(00000002), ref: 003DB69F
                                                                                                    • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 0042ED3C
                                                                                                    • ImageList_EndDrag.COMCTL32 ref: 0042ED42
                                                                                                    • ReleaseCapture.USER32 ref: 0042ED48
                                                                                                    • SetWindowTextW.USER32(?,00000000), ref: 0042EDF0
                                                                                                    • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0042EE03
                                                                                                    • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 0042EEDC
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                                                                    • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                                                                    • API String ID: 1924731296-2107944366
                                                                                                    • Opcode ID: 46dcd482cc206871419d37ff5ac55536830230f6e5949935bc53b52d53e1dd25
                                                                                                    • Instruction ID: 6b76e8e52b8d3cbdf562cfd74741847c0b00b5572a91926044bfe7d77c05345d
                                                                                                    • Opcode Fuzzy Hash: 46dcd482cc206871419d37ff5ac55536830230f6e5949935bc53b52d53e1dd25
                                                                                                    • Instruction Fuzzy Hash: 6E51AA74204300AFD711DF20EC96F6E77E8AF88304F40492EF9959B2A2DB749904CB56
                                                                                                    Function 004145C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 004145FF
                                                                                                    • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0041462B
                                                                                                    • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 0041466D
                                                                                                    • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00414682
                                                                                                    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0041468F
                                                                                                    • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 004146BF
                                                                                                    • InternetCloseHandle.WININET(00000000), ref: 00414706
                                                                                                      • Part of subcall function 00415052: GetLastError.KERNEL32(?,?,004143CC,00000000,00000000,00000001), ref: 00415067
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
                                                                                                    • String ID:
                                                                                                    • API String ID: 1241431887-3916222277
                                                                                                    • Opcode ID: fea246148729e09df4cff6f42daa92ea11412d4aef3cc8b50100aa9c432bc76b
                                                                                                    • Instruction ID: 307626fa3f4240190a4287836ac0d9143abfe61240173af0d86c4f82db4387f8
                                                                                                    • Opcode Fuzzy Hash: fea246148729e09df4cff6f42daa92ea11412d4aef3cc8b50100aa9c432bc76b
                                                                                                    • Instruction Fuzzy Hash: E54171B5501205BFEB019F90CC85FFB7BACFF4A358F00412AFA059A181D77899858BA8
                                                                                                    Function 0041B644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetModuleFileNameW.KERNEL32(?,?,00000104,?,0045DC00), ref: 0041B715
                                                                                                    • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0045DC00), ref: 0041B749
                                                                                                    • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 0041B8C1
                                                                                                    • SysFreeString.OLEAUT32(?), ref: 0041B8EB
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                                                                    • String ID:
                                                                                                    • API String ID: 560350794-0
                                                                                                    • Opcode ID: a84b3d48d34917f3b2343327303a8f1cd7eb6700d1d9cb364736c5e4429a34aa
                                                                                                    • Instruction ID: 0b5413fabf26d5993c65c56572fe299e76dc50d69875c2fe25b9de64d23e3bb8
                                                                                                    • Opcode Fuzzy Hash: a84b3d48d34917f3b2343327303a8f1cd7eb6700d1d9cb364736c5e4429a34aa
                                                                                                    • Instruction Fuzzy Hash: A0F12975A00209EFCB04DF94C884EEEB7B9FF49715F108459F915AB250DB35AE82CB94
                                                                                                    Function 004224D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 004224F5
                                                                                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00422688
                                                                                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 004226AC
                                                                                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 004226EC
                                                                                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0042270E
                                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0042286F
                                                                                                    • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 004228A1
                                                                                                    • CloseHandle.KERNEL32(?), ref: 004228D0
                                                                                                    • CloseHandle.KERNEL32(?), ref: 00422947
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 4090791747-0
                                                                                                    • Opcode ID: 76e851d65c886f82a4a7eaf120fafb787dc526f28858da171dafd1aebb69789b
                                                                                                    • Instruction ID: b3386ad78ac0dfad486c3dd58ac1564621f2d9ae23fac35c67d1cb353978e810
                                                                                                    • Opcode Fuzzy Hash: 76e851d65c886f82a4a7eaf120fafb787dc526f28858da171dafd1aebb69789b
                                                                                                    • Instruction Fuzzy Hash: CAD1BE32604210EFC715EF24D991B6ABBE1AF85310F14896EF8899F3A2DB74DC40CB56
                                                                                                    Function 0042B33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0042B3F4
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: InvalidateRect
                                                                                                    • String ID:
                                                                                                    • API String ID: 634782764-0
                                                                                                    • Opcode ID: 4c23b3c34412d169830b54cf3ff891b06c62de4cccce53f91ba37896beece60a
                                                                                                    • Instruction ID: eb2a75ac73367e702cb8b0190add648263bd6ff72d95e3df305f2de137b37737
                                                                                                    • Opcode Fuzzy Hash: 4c23b3c34412d169830b54cf3ff891b06c62de4cccce53f91ba37896beece60a
                                                                                                    • Instruction Fuzzy Hash: 4651D630700224BBEF209F14EC85B5E7B64EB05358FA48017FA14DA2E2D779E9808BD9
                                                                                                    Function 003DA699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0043DB1B
                                                                                                    • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0043DB3C
                                                                                                    • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0043DB51
                                                                                                    • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0043DB6E
                                                                                                    • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0043DB95
                                                                                                    • DestroyIcon.USER32(00000000,?,?,?,?,?,?,003DA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0043DBA0
                                                                                                    • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0043DBBD
                                                                                                    • DestroyIcon.USER32(00000000,?,?,?,?,?,?,003DA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0043DBC8
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                                                    • String ID:
                                                                                                    • API String ID: 1268354404-0
                                                                                                    • Opcode ID: 6d4fd687033336db0102fec156621eb714cec194d0f61b7f83e9c771daa9cc7c
                                                                                                    • Instruction ID: cf426cfcf53bf58b557f07ec93441e7bc7945c0081fe07ef3b39bb42e133ec38
                                                                                                    • Opcode Fuzzy Hash: 6d4fd687033336db0102fec156621eb714cec194d0f61b7f83e9c771daa9cc7c
                                                                                                    • Instruction Fuzzy Hash: D7519C71A00608EFDB21DF64ED81FAA77B8AB08350F11052AF9469B7E0D774ED50DB58
                                                                                                    Function 00407555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 00406EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00405FA6,?), ref: 00406ED8
                                                                                                      • Part of subcall function 00406EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00405FA6,?), ref: 00406EF1
                                                                                                      • Part of subcall function 004072CB: GetFileAttributesW.KERNEL32(?,00406019), ref: 004072CC
                                                                                                    • lstrcmpiW.KERNEL32(?,?), ref: 004075CA
                                                                                                    • _wcscmp.LIBCMT ref: 004075E2
                                                                                                    • MoveFileW.KERNEL32(?,?), ref: 004075FB
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                                                                    • String ID:
                                                                                                    • API String ID: 793581249-0
                                                                                                    • Opcode ID: 3286114921ff57c4c81c1e90e55a7ed3dbce58da4887cf1a86289e8a7ce6a602
                                                                                                    • Instruction ID: fc8d18d29c91c3a2e4e87e60fa13913e7e962d3f2f11148d1f3813d469c30221
                                                                                                    • Opcode Fuzzy Hash: 3286114921ff57c4c81c1e90e55a7ed3dbce58da4887cf1a86289e8a7ce6a602
                                                                                                    • Instruction Fuzzy Hash: 2E5171B2E092299ADF61EB94DC41DDE73BC9F08320B1041ABF605E7181EA74A6C5CB65
                                                                                                    Function 003DEA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0043DAD1,00000004,00000000,00000000), ref: 003DEAEB
                                                                                                    • ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,0043DAD1,00000004,00000000,00000000), ref: 003DEB32
                                                                                                    • ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,0043DAD1,00000004,00000000,00000000), ref: 0043DC86
                                                                                                    • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0043DAD1,00000004,00000000,00000000), ref: 0043DCF2
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ShowWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 1268545403-0
                                                                                                    • Opcode ID: 2a89017f3038257ee9295bc2ecf90a66f88f2ed317572504aead0cb9d4553f11
                                                                                                    • Instruction ID: 27bd7b97636c59d8075ba7b39f89759510216f2df4a85cf47518253c6431a738
                                                                                                    • Opcode Fuzzy Hash: 2a89017f3038257ee9295bc2ecf90a66f88f2ed317572504aead0cb9d4553f11
                                                                                                    • Instruction Fuzzy Hash: F5411B72A1C6809BD7376728BD8DA2B7E99BB47305F1A281FE0874EB61C6747840D315
                                                                                                    Function 003FB263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,003FAEF1,00000B00,?,?), ref: 003FB26C
                                                                                                    • HeapAlloc.KERNEL32(00000000,?,003FAEF1,00000B00,?,?), ref: 003FB273
                                                                                                    • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,003FAEF1,00000B00,?,?), ref: 003FB288
                                                                                                    • GetCurrentProcess.KERNEL32(?,00000000,?,003FAEF1,00000B00,?,?), ref: 003FB290
                                                                                                    • DuplicateHandle.KERNEL32(00000000,?,003FAEF1,00000B00,?,?), ref: 003FB293
                                                                                                    • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,003FAEF1,00000B00,?,?), ref: 003FB2A3
                                                                                                    • GetCurrentProcess.KERNEL32(003FAEF1,00000000,?,003FAEF1,00000B00,?,?), ref: 003FB2AB
                                                                                                    • DuplicateHandle.KERNEL32(00000000,?,003FAEF1,00000B00,?,?), ref: 003FB2AE
                                                                                                    • CreateThread.KERNEL32(00000000,00000000,003FB2D4,00000000,00000000,00000000), ref: 003FB2C8
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                    • String ID:
                                                                                                    • API String ID: 1957940570-0
                                                                                                    • Opcode ID: 430bfa104ca87dad8d38bb5891ce413e382415b0e20c4b1568bf013b6ed0d03b
                                                                                                    • Instruction ID: 32d41d275b9050c08636ccb263a6e9233c458e1314cef203c0d15750e399cc03
                                                                                                    • Opcode Fuzzy Hash: 430bfa104ca87dad8d38bb5891ce413e382415b0e20c4b1568bf013b6ed0d03b
                                                                                                    • Instruction Fuzzy Hash: BF01BBB5640308BFE710AFA5DC49F6B7BACEB89B11F018421FA05DB1A1CA749C10CB65
                                                                                                    Function 0041C43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON
                                                                                                    Download Yara Rule
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID: NULL Pointer assignment$Not an Object type
                                                                                                    • API String ID: 0-572801152
                                                                                                    • Opcode ID: 9e3fb3989cea643db63aab7e977efd354341499e28ec5a3e750dfc2c3f9128ba
                                                                                                    • Instruction ID: 04a75affc1fe87f7357caa7ddeec0ef2ed18a26a6ba969eebfdfad5070d7f8e1
                                                                                                    • Opcode Fuzzy Hash: 9e3fb3989cea643db63aab7e977efd354341499e28ec5a3e750dfc2c3f9128ba
                                                                                                    • Instruction Fuzzy Hash: 52E1B371A4021AABDF14DFA4DCC1BEE77B5EF48354F14402AE905AB381D778AD81CB98
                                                                                                    Function 004116DA Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 309COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C936C: __swprintf.LIBCMT ref: 003C93AB
                                                                                                      • Part of subcall function 003C936C: __itow.LIBCMT ref: 003C93DF
                                                                                                      • Part of subcall function 003DC6F4: _wcscpy.LIBCMT ref: 003DC717
                                                                                                    • _wcstok.LIBCMT ref: 0041184E
                                                                                                    • _wcscpy.LIBCMT ref: 004118DD
                                                                                                    • _memset.LIBCMT ref: 00411910
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                                                                    • String ID: X$p2Gl2G
                                                                                                    • API String ID: 774024439-1242963504
                                                                                                    • Opcode ID: 82e1252f826702c1dffe1b6b597dcb7e84caec8d16082be6e3c019c0614f3738
                                                                                                    • Instruction ID: 06ef5420704accdefc079abd5f4fd6b0e0422d38a482934db67e23dc28e2332b
                                                                                                    • Opcode Fuzzy Hash: 82e1252f826702c1dffe1b6b597dcb7e84caec8d16082be6e3c019c0614f3738
                                                                                                    • Instruction Fuzzy Hash: 03C18C316043409FC725EF64C981F9AB7E0BF85354F04892EF9999B2A2DB74EC45CB86
                                                                                                    Function 00429A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00429B19
                                                                                                    • SendMessageW.USER32(?,00001036,00000000,?), ref: 00429B2D
                                                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00429B47
                                                                                                    • _wcscat.LIBCMT ref: 00429BA2
                                                                                                    • SendMessageW.USER32(?,00001057,00000000,?), ref: 00429BB9
                                                                                                    • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00429BE7
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$Window_wcscat
                                                                                                    • String ID: SysListView32
                                                                                                    • API String ID: 307300125-78025650
                                                                                                    • Opcode ID: 4ec8a2b0132e717477e222a4c70b32246490986706a2def5e2c41226a9975391
                                                                                                    • Instruction ID: 10af57b61caa7ba8a13c4f54a73f235de69f77c54dbf20df5bb7d155c4567779
                                                                                                    • Opcode Fuzzy Hash: 4ec8a2b0132e717477e222a4c70b32246490986706a2def5e2c41226a9975391
                                                                                                    • Instruction Fuzzy Hash: 0F41E270A00358AFDB219FA4DC85BEF7BA8EF08350F10442BF549A7291D7759D85CB68
                                                                                                    Function 0042172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 00406532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00406554
                                                                                                      • Part of subcall function 00406532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00406564
                                                                                                      • Part of subcall function 00406532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 004065F9
                                                                                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0042179A
                                                                                                    • GetLastError.KERNEL32 ref: 004217AD
                                                                                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 004217D9
                                                                                                    • TerminateProcess.KERNEL32(00000000,00000000), ref: 00421855
                                                                                                    • GetLastError.KERNEL32(00000000), ref: 00421860
                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 00421895
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                                                                    • String ID: SeDebugPrivilege
                                                                                                    • API String ID: 2533919879-2896544425
                                                                                                    • Opcode ID: 17490be3aa054cf949f115efe8a0f03ac9ffbd925f7ce65ee88ce349991091a1
                                                                                                    • Instruction ID: 9fed334ee3267f8b2a4b351ce3e8dbca380890f0c01029991956f913cde42d41
                                                                                                    • Opcode Fuzzy Hash: 17490be3aa054cf949f115efe8a0f03ac9ffbd925f7ce65ee88ce349991091a1
                                                                                                    • Instruction Fuzzy Hash: 3341A076700211AFDB05EF54D8D5F6E77A1AF54300F04806AF9069F3D2DB79A9018B99
                                                                                                    Function 00405819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadIconW.USER32(00000000,00007F03), ref: 004058B8
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: IconLoad
                                                                                                    • String ID: blank$info$question$stop$warning
                                                                                                    • API String ID: 2457776203-404129466
                                                                                                    • Opcode ID: 711d897808ac365d7e2d7765c8d42b4c047ba694ab6bb0b4c7e588acc7801de0
                                                                                                    • Instruction ID: cbde725aa83d4b1f0b857f227285bb834c2b7c4bd975fdd9b51a544145336642
                                                                                                    • Opcode Fuzzy Hash: 711d897808ac365d7e2d7765c8d42b4c047ba694ab6bb0b4c7e588acc7801de0
                                                                                                    • Instruction Fuzzy Hash: F9110837609752BAE7156B559C82DAB33ACDF25710B20803BF900B53C1E7B8AA614A6D
                                                                                                    Function 0040A729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 0040A806
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ArraySafeVartype
                                                                                                    • String ID:
                                                                                                    • API String ID: 1725837607-0
                                                                                                    • Opcode ID: 0af0f9e89f005174a75921f4593054f040ba50e18d81dff6164487843b24be0f
                                                                                                    • Instruction ID: e662f25bc3f47871926fe608975479ee18d42bb76b2d9bb5cf882c529c29657c
                                                                                                    • Opcode Fuzzy Hash: 0af0f9e89f005174a75921f4593054f040ba50e18d81dff6164487843b24be0f
                                                                                                    • Instruction Fuzzy Hash: 6BC18D75A0021A9FDB00DF94D481BAEB7B4EF08315F24847AE605EB381D738A955CF9A
                                                                                                    Function 00406B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00406B63
                                                                                                    • LoadStringW.USER32(00000000), ref: 00406B6A
                                                                                                    • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00406B80
                                                                                                    • LoadStringW.USER32(00000000), ref: 00406B87
                                                                                                    • _wprintf.LIBCMT ref: 00406BAD
                                                                                                    • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00406BCB
                                                                                                    Strings
                                                                                                    • %s (%d) : ==> %s: %s %s, xrefs: 00406BA8
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: HandleLoadModuleString$Message_wprintf
                                                                                                    • String ID: %s (%d) : ==> %s: %s %s
                                                                                                    • API String ID: 3648134473-3128320259
                                                                                                    • Opcode ID: 664d4128b0bc06dee02538ba9841cf4ca9226de9ec4fb8b424f7098647b7059a
                                                                                                    • Instruction ID: 1870d4b62063792b7e6f9c708720ec186cdcecc02e2ba2f53c1673bb467df3be
                                                                                                    • Opcode Fuzzy Hash: 664d4128b0bc06dee02538ba9841cf4ca9226de9ec4fb8b424f7098647b7059a
                                                                                                    • Instruction Fuzzy Hash: DD0136F6900218BFEB11AB949D89EFB777CD704305F0045B2BB46E6141EA749E848F79
                                                                                                    Function 00422B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 00423C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00422BB5,?,?), ref: 00423C1D
                                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00422BF6
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: BuffCharConnectRegistryUpper
                                                                                                    • String ID:
                                                                                                    • API String ID: 2595220575-0
                                                                                                    • Opcode ID: 0f8b0ecf11644f37a1dd35d4ae61d575005570e4407511dbaf8a4114e6a4afd6
                                                                                                    • Instruction ID: 58663450f37154fc02a0fb428b743828c0fb31b78d0a6aab214fe214db0cb592
                                                                                                    • Opcode Fuzzy Hash: 0f8b0ecf11644f37a1dd35d4ae61d575005570e4407511dbaf8a4114e6a4afd6
                                                                                                    • Instruction Fuzzy Hash: A891AA35604201AFCB11EF54D881F6EB7E5BF88314F44881EF9969B2A2CB78ED05CB46
                                                                                                    Function 004195BF Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • select.WSOCK32 ref: 00419691
                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 0041969E
                                                                                                    • __WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 004196C8
                                                                                                    • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 004196E9
                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 004196F8
                                                                                                    • htons.WSOCK32(?,?,?,00000000,?), ref: 004197AA
                                                                                                    • inet_ntoa.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,0045DC00), ref: 00419765
                                                                                                      • Part of subcall function 003FD2FF: _strlen.LIBCMT ref: 003FD309
                                                                                                    • _strlen.LIBCMT ref: 00419800
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorLast_strlen$htonsinet_ntoaselect
                                                                                                    • String ID:
                                                                                                    • API String ID: 3480843537-0
                                                                                                    • Opcode ID: ba870c442e2e1e4f9ac513609fafbc3a39a1e137800b47ad75f693ac74ccb977
                                                                                                    • Instruction ID: a10c8c1497b9dbf453c9f4bb4431367ae1644c10c9064f691bf2c853d8d8e332
                                                                                                    • Opcode Fuzzy Hash: ba870c442e2e1e4f9ac513609fafbc3a39a1e137800b47ad75f693ac74ccb977
                                                                                                    • Instruction Fuzzy Hash: 60810E72504200ABC315EF64CC96FABB7E8EF85714F104A2EF5559B2A1EB34DD04CBA6
                                                                                                    Function 003EA979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __mtinitlocknum.LIBCMT ref: 003EA991
                                                                                                      • Part of subcall function 003E7D7C: __FF_MSGBANNER.LIBCMT ref: 003E7D91
                                                                                                      • Part of subcall function 003E7D7C: __NMSG_WRITE.LIBCMT ref: 003E7D98
                                                                                                      • Part of subcall function 003E7D7C: __malloc_crt.LIBCMT ref: 003E7DB8
                                                                                                    • __lock.LIBCMT ref: 003EA9A4
                                                                                                    • __lock.LIBCMT ref: 003EA9F0
                                                                                                    • InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00476DE0,00000018,003F5E7B,?,00000000,00000109), ref: 003EAA0C
                                                                                                    • EnterCriticalSection.KERNEL32(8000000C,00476DE0,00000018,003F5E7B,?,00000000,00000109), ref: 003EAA29
                                                                                                    • LeaveCriticalSection.KERNEL32(8000000C), ref: 003EAA39
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
                                                                                                    • String ID:
                                                                                                    • API String ID: 1422805418-0
                                                                                                    • Opcode ID: f2a2ddfd417f6977b2bb3113cbc647277f0ed3017c9877f12cb77fc7edd029c5
                                                                                                    • Instruction ID: 264c00d378720cba4bb8dfe7d84ba1c3a13fe497f45eeac5286f9a1559b82baa
                                                                                                    • Opcode Fuzzy Hash: f2a2ddfd417f6977b2bb3113cbc647277f0ed3017c9877f12cb77fc7edd029c5
                                                                                                    • Instruction Fuzzy Hash: 13415B71900BA59BEB119F6AC94579CB7B06F01334F21833CE425AF2D1D774A805CB86
                                                                                                    Function 00428ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • DeleteObject.GDI32(00000000), ref: 00428EE4
                                                                                                    • GetDC.USER32(00000000), ref: 00428EEC
                                                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00428EF7
                                                                                                    • ReleaseDC.USER32(00000000,00000000), ref: 00428F03
                                                                                                    • CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00428F3F
                                                                                                    • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00428F50
                                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0042BD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00428F8A
                                                                                                    • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00428FAA
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 3864802216-0
                                                                                                    • Opcode ID: 3cede90085976ca7db3a741e33d359cc63be6b5a72c2ceb6de48339e7badf48e
                                                                                                    • Instruction ID: 8f41effdd62965166289a62165d0b611b97fc8bade996f15c5268b82640317fc
                                                                                                    • Opcode Fuzzy Hash: 3cede90085976ca7db3a741e33d359cc63be6b5a72c2ceb6de48339e7badf48e
                                                                                                    • Instruction Fuzzy Hash: 23319F76601224BFEB108F50DC4AFEB3BADEF4A715F054065FE09DA291C6799841CB78
                                                                                                    Function 00430133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DB34E: GetWindowLongW.USER32(?,000000EB), ref: 003DB35F
                                                                                                    • GetSystemMetrics.USER32(0000000F), ref: 0043016D
                                                                                                    • MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 0043038D
                                                                                                    • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 004303AB
                                                                                                    • InvalidateRect.USER32(?,00000000,00000001,?), ref: 004303D6
                                                                                                    • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 004303FF
                                                                                                    • ShowWindow.USER32(00000003,00000000), ref: 00430421
                                                                                                    • DefDlgProcW.USER32(?,00000005,?,?), ref: 00430440
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
                                                                                                    • String ID:
                                                                                                    • API String ID: 3356174886-0
                                                                                                    • Opcode ID: 67ce826b2261543ebf53166a9abc27eef04ab61c38c3956f22bb6fd1740e2b10
                                                                                                    • Instruction ID: 1e099f221546d82e042ada2e9f964fb7573819a533775a3ef62b368a8482ffe0
                                                                                                    • Opcode Fuzzy Hash: 67ce826b2261543ebf53166a9abc27eef04ab61c38c3956f22bb6fd1740e2b10
                                                                                                    • Instruction Fuzzy Hash: 72A1C135600616EFDB18CF68C9957BEBBB1FF08700F149266EC54A7290D738AD61CB94
                                                                                                    Function 003DAE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: 78220c9d309a24bf4b16da29ef76edd990bb455a3d4754881c926e09e973819e
                                                                                                    • Instruction ID: c271c54422fefa36e74a820dee41fe23141e8902cbdc5f24121bdea259ddb11c
                                                                                                    • Opcode Fuzzy Hash: 78220c9d309a24bf4b16da29ef76edd990bb455a3d4754881c926e09e973819e
                                                                                                    • Instruction Fuzzy Hash: 2D717CB1900509EFCB15CF98DD48AAEBB78FF89314F14819AF915AB350C3349A11CF65
                                                                                                    Function 00422230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 0042225A
                                                                                                    • _memset.LIBCMT ref: 00422323
                                                                                                    • ShellExecuteExW.SHELL32(?), ref: 00422368
                                                                                                      • Part of subcall function 003C936C: __swprintf.LIBCMT ref: 003C93AB
                                                                                                      • Part of subcall function 003C936C: __itow.LIBCMT ref: 003C93DF
                                                                                                      • Part of subcall function 003DC6F4: _wcscpy.LIBCMT ref: 003DC717
                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0042242F
                                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 0042243E
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
                                                                                                    • String ID: @
                                                                                                    • API String ID: 4082843840-2766056989
                                                                                                    • Opcode ID: 417884a088f6dc21a9333d9b49fb2c96d7cfa6fa553cb2972f70dbc3eb7e0d47
                                                                                                    • Instruction ID: c5ed25a921fad265707dc75162d323e884fabadc5ce11e5708069fff6094f8ee
                                                                                                    • Opcode Fuzzy Hash: 417884a088f6dc21a9333d9b49fb2c96d7cfa6fa553cb2972f70dbc3eb7e0d47
                                                                                                    • Instruction Fuzzy Hash: AF71B375A00629EFCF05EFA4D981AAEB7F5FF48310F10845AE845AB351CB74AD40CB94
                                                                                                    Function 00403BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetParent.USER32(00000000), ref: 00403C02
                                                                                                    • GetKeyboardState.USER32(?), ref: 00403C17
                                                                                                    • SetKeyboardState.USER32(?), ref: 00403C78
                                                                                                    • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00403CA4
                                                                                                    • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00403CC1
                                                                                                    • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00403D05
                                                                                                    • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00403D26
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessagePost$KeyboardState$Parent
                                                                                                    • String ID:
                                                                                                    • API String ID: 87235514-0
                                                                                                    • Opcode ID: 37c71c62e96c55568dd6bbe6f1da3de2af8c46b279cc75592ad109bbb282e29f
                                                                                                    • Instruction ID: a719cae96ecd0ddb780a5d625766fb4c1f8560ce19b568864eea6eabca8ffd24
                                                                                                    • Opcode Fuzzy Hash: 37c71c62e96c55568dd6bbe6f1da3de2af8c46b279cc75592ad109bbb282e29f
                                                                                                    • Instruction Fuzzy Hash: 665129A15087D53DFB324B248C05B777EAC5F46305F0884AAE1C57A5C3D2B8EE84D758
                                                                                                    Function 00428FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00428FE7
                                                                                                    • GetWindowLongW.USER32(0105EDA0,000000F0), ref: 0042901A
                                                                                                    • GetWindowLongW.USER32(0105EDA0,000000F0), ref: 0042904F
                                                                                                    • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00429081
                                                                                                    • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 004290AB
                                                                                                    • GetWindowLongW.USER32(00000000,000000F0), ref: 004290BC
                                                                                                    • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 004290D6
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: LongWindow$MessageSend
                                                                                                    • String ID:
                                                                                                    • API String ID: 2178440468-0
                                                                                                    • Opcode ID: 50bd8b587896760e5ca2402488596739758c86f75c085dc6e5b06e7bb7489ebd
                                                                                                    • Instruction ID: 448ede2e38e9abd9479bcb94bf32fbb853393f2a075d2734f47c1731a457d2b9
                                                                                                    • Opcode Fuzzy Hash: 50bd8b587896760e5ca2402488596739758c86f75c085dc6e5b06e7bb7489ebd
                                                                                                    • Instruction Fuzzy Hash: 85315934B00228DFDB21CF58EC85F6937A5FB4A314F55016AF6199B2B1CB75AC41CB49
                                                                                                    Function 004008AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 004008F2
                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00400918
                                                                                                    • SysAllocString.OLEAUT32(00000000), ref: 0040091B
                                                                                                    • SysAllocString.OLEAUT32(?), ref: 00400939
                                                                                                    • SysFreeString.OLEAUT32(?), ref: 00400942
                                                                                                    • StringFromGUID2.OLE32(?,?,00000028), ref: 00400967
                                                                                                    • SysAllocString.OLEAUT32(?), ref: 00400975
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                                    • String ID:
                                                                                                    • API String ID: 3761583154-0
                                                                                                    • Opcode ID: fa43e6eaf043b2d932bf11bc524381eb2592872181276786fce24e15444edc01
                                                                                                    • Instruction ID: d888eb8cb0ce75bf047ff05af3d7c1f3caa5c29f05d091d1f19920104ef070c1
                                                                                                    • Opcode Fuzzy Hash: fa43e6eaf043b2d932bf11bc524381eb2592872181276786fce24e15444edc01
                                                                                                    • Instruction Fuzzy Hash: 34216776601219AFDB109F68DC84EBB73ACEF09360F008136F919EB291D674EC458768
                                                                                                    Function 00402472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __wcsnicmp
                                                                                                    • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                                    • API String ID: 1038674560-2734436370
                                                                                                    • Opcode ID: 4606f661944facd6d4748f15e6b346522152d429261315d9f7aa99b41f3dc042
                                                                                                    • Instruction ID: 45647a329eae3c4dd8ebf147bcb3459fd32b786a4e5cc18221c81b9a65d80012
                                                                                                    • Opcode Fuzzy Hash: 4606f661944facd6d4748f15e6b346522152d429261315d9f7aa99b41f3dc042
                                                                                                    • Instruction Fuzzy Hash: 87213A3210456177C622EA249E1AF777398EFA5304F60403BF846BB2C2E6F99942C39D
                                                                                                    Function 00400986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 004009CB
                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 004009F1
                                                                                                    • SysAllocString.OLEAUT32(00000000), ref: 004009F4
                                                                                                    • SysAllocString.OLEAUT32 ref: 00400A15
                                                                                                    • SysFreeString.OLEAUT32 ref: 00400A1E
                                                                                                    • StringFromGUID2.OLE32(?,?,00000028), ref: 00400A38
                                                                                                    • SysAllocString.OLEAUT32(?), ref: 00400A46
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                                    • String ID:
                                                                                                    • API String ID: 3761583154-0
                                                                                                    • Opcode ID: 5ce469ab8d75c97634e1128a0017079992b4a0eac77e6db2892b699327c6f212
                                                                                                    • Instruction ID: c80f53d8eb905aad1b8649bf1b3dd6db50a43d608b595c5a402333fddfee75b4
                                                                                                    • Opcode Fuzzy Hash: 5ce469ab8d75c97634e1128a0017079992b4a0eac77e6db2892b699327c6f212
                                                                                                    • Instruction Fuzzy Hash: 38215879701204AFDB10DFA8DC89D6BB7ECEF59360B448136F909DB2A1D674EC418B58
                                                                                                    Function 0042A2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 003DD1BA
                                                                                                      • Part of subcall function 003DD17C: GetStockObject.GDI32(00000011), ref: 003DD1CE
                                                                                                      • Part of subcall function 003DD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 003DD1D8
                                                                                                    • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 0042A32D
                                                                                                    • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0042A33A
                                                                                                    • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0042A345
                                                                                                    • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 0042A354
                                                                                                    • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 0042A360
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$CreateObjectStockWindow
                                                                                                    • String ID: Msctls_Progress32
                                                                                                    • API String ID: 1025951953-3636473452
                                                                                                    • Opcode ID: 1dec2319aeb51618e462731bb36fe4669867aa31b3437f0c5580281c53b65089
                                                                                                    • Instruction ID: c1d461792fa4e2f9990a26ed2615a5a419b10cfe2b6dc03c0e73be91403470d2
                                                                                                    • Opcode Fuzzy Hash: 1dec2319aeb51618e462731bb36fe4669867aa31b3437f0c5580281c53b65089
                                                                                                    • Instruction Fuzzy Hash: 4B11D6B1200119BFEF118F60DC85EE77F5DFF08398F014115BA04A6060C7759C21DBA4
                                                                                                    Function 003DCCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetClientRect.USER32(?,?), ref: 003DCCF6
                                                                                                    • GetWindowRect.USER32(?,?), ref: 003DCD37
                                                                                                    • ScreenToClient.USER32(?,?), ref: 003DCD5F
                                                                                                    • GetClientRect.USER32(?,?), ref: 003DCE8C
                                                                                                    • GetWindowRect.USER32(?,?), ref: 003DCEA5
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Rect$Client$Window$Screen
                                                                                                    • String ID:
                                                                                                    • API String ID: 1296646539-0
                                                                                                    • Opcode ID: 31f58f068eb09e690df46f67d3b4d5412be637457f30128bb241913a9e106470
                                                                                                    • Instruction ID: 3c6682c3caa797846d7be1a26fcb77685d0f7514665058dad9aa364f0983e118
                                                                                                    • Opcode Fuzzy Hash: 31f58f068eb09e690df46f67d3b4d5412be637457f30128bb241913a9e106470
                                                                                                    • Instruction Fuzzy Hash: C1B15C7A92024ADBDF14CFA9C4807EEB7B5FF08300F14A12AEC599B750DB34A950CB54
                                                                                                    Function 00421BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CreateToolhelp32Snapshot.KERNEL32 ref: 00421C18
                                                                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 00421C26
                                                                                                    • __wsplitpath.LIBCMT ref: 00421C54
                                                                                                      • Part of subcall function 003E1DFC: __wsplitpath_helper.LIBCMT ref: 003E1E3C
                                                                                                    • _wcscat.LIBCMT ref: 00421C69
                                                                                                    • Process32NextW.KERNEL32(00000000,?), ref: 00421CDF
                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00421CF1
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
                                                                                                    • String ID:
                                                                                                    • API String ID: 1380811348-0
                                                                                                    • Opcode ID: 39c22061ea19f018a628334c79578759fcdf0efcee2b336c011bec375dd31b33
                                                                                                    • Instruction ID: eff57f6226801d5801bc9e70d0dec5bb789d336d7640ae031ead1bedeb2fc5f3
                                                                                                    • Opcode Fuzzy Hash: 39c22061ea19f018a628334c79578759fcdf0efcee2b336c011bec375dd31b33
                                                                                                    • Instruction Fuzzy Hash: D75180715043409FD721DF64D845FABB7E8EF88714F00492EF5899B251DB74EA04CB96
                                                                                                    Function 00422FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 00423C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00422BB5,?,?), ref: 00423C1D
                                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004230AF
                                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004230EF
                                                                                                    • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00423112
                                                                                                    • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0042313B
                                                                                                    • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0042317E
                                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 0042318B
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                                                    • String ID:
                                                                                                    • API String ID: 3451389628-0
                                                                                                    • Opcode ID: d5136857f69f64c5384c6dec99ccbec855620349a906561e44b820e6bdb1a0e0
                                                                                                    • Instruction ID: 63efaabcc98661aa14df94d0596777a54eb52d07836c6453e1a1e6edd584e5ba
                                                                                                    • Opcode Fuzzy Hash: d5136857f69f64c5384c6dec99ccbec855620349a906561e44b820e6bdb1a0e0
                                                                                                    • Instruction Fuzzy Hash: 33516731608200AFC701EF64C885E6ABBF9FF89304F04492EF5559B2A1DB79EE15CB56
                                                                                                    Function 004284DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetMenu.USER32(?), ref: 00428540
                                                                                                    • GetMenuItemCount.USER32(00000000), ref: 00428577
                                                                                                    • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0042859F
                                                                                                    • GetMenuItemID.USER32(?,?), ref: 0042860E
                                                                                                    • GetSubMenu.USER32(?,?), ref: 0042861C
                                                                                                    • PostMessageW.USER32(?,00000111,?,00000000), ref: 0042866D
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Menu$Item$CountMessagePostString
                                                                                                    • String ID:
                                                                                                    • API String ID: 650687236-0
                                                                                                    • Opcode ID: d9d07cf9f57eff584338c349953ea91066e6319a21a12e61aea43d67413b3c75
                                                                                                    • Instruction ID: 626e6518d77386dadd66ec44ff4bd3af3f1945e328a4156352d72e51eec564dd
                                                                                                    • Opcode Fuzzy Hash: d9d07cf9f57eff584338c349953ea91066e6319a21a12e61aea43d67413b3c75
                                                                                                    • Instruction Fuzzy Hash: 2B51BE75E01225EFCB11EF64D841AAEB7F4FF48310F10446AE915BB391CB78AE418B99
                                                                                                    Function 00404AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 00404B10
                                                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00404B5B
                                                                                                    • IsMenu.USER32(00000000), ref: 00404B7B
                                                                                                    • CreatePopupMenu.USER32 ref: 00404BAF
                                                                                                    • GetMenuItemCount.USER32(000000FF), ref: 00404C0D
                                                                                                    • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00404C3E
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 3311875123-0
                                                                                                    • Opcode ID: 8fc8470a82570daa9f114815a4bab23f4808376eb51437d7d4288d157036ab42
                                                                                                    • Instruction ID: a97d6a5ea947bd3fb2ed45bdf65c27d0a6f0e80280040eeefba76638a4ab591a
                                                                                                    • Opcode Fuzzy Hash: 8fc8470a82570daa9f114815a4bab23f4808376eb51437d7d4288d157036ab42
                                                                                                    • Instruction Fuzzy Hash: B351F4B0605209EFDF20CF64C888BAEBBF4AF85318F14417AE615AB2D0D778D940CB59
                                                                                                    Function 00418DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,0045DC00), ref: 00418E7C
                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00418E89
                                                                                                    • __WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 00418EAD
                                                                                                    • #16.WSOCK32(?,?,00000000,00000000), ref: 00418EC5
                                                                                                    • _strlen.LIBCMT ref: 00418EF7
                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00418F6A
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorLast$_strlenselect
                                                                                                    • String ID:
                                                                                                    • API String ID: 2217125717-0
                                                                                                    • Opcode ID: f3540b3788ccb26649b45e01ce1d80173a1f61fd11ab1bfd81d317c5ea7ec86e
                                                                                                    • Instruction ID: 298cc891da517a1988cdad2f9d296df13e470cf2bfe9fc7f619a29a7e1ee66c0
                                                                                                    • Opcode Fuzzy Hash: f3540b3788ccb26649b45e01ce1d80173a1f61fd11ab1bfd81d317c5ea7ec86e
                                                                                                    • Instruction Fuzzy Hash: 3841A071900204ABCB14EBA4CD85EEEB7B9AF48314F10466EF51ADB2D1DF34AE41CB64
                                                                                                    Function 003DABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DB34E: GetWindowLongW.USER32(?,000000EB), ref: 003DB35F
                                                                                                    • BeginPaint.USER32(?,?,?), ref: 003DAC2A
                                                                                                    • GetWindowRect.USER32(?,?), ref: 003DAC8E
                                                                                                    • ScreenToClient.USER32(?,?), ref: 003DACAB
                                                                                                    • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 003DACBC
                                                                                                    • EndPaint.USER32(?,?,?,?,?), ref: 003DAD06
                                                                                                    • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0043E673
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
                                                                                                    • String ID:
                                                                                                    • API String ID: 2592858361-0
                                                                                                    • Opcode ID: 6aad81e949c99aa006ddf476997afafe248645b34d6686fc08684061a43c63d7
                                                                                                    • Instruction ID: 03d1120c7e936f9d49f546f4ece96aafa5069f1e85658739052a42796e3da6cb
                                                                                                    • Opcode Fuzzy Hash: 6aad81e949c99aa006ddf476997afafe248645b34d6686fc08684061a43c63d7
                                                                                                    • Instruction Fuzzy Hash: 8E41EE72501600AFC711DF24EC84FBB7BACEB59320F14062AF9A49B2B1D330A845DB66
                                                                                                    Function 0042E397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • ShowWindow.USER32(00481628,00000000,00481628,00000000,00000000,00481628,?,0043DC5D,00000000,?,00000000,00000000,00000000,?,0043DAD1,00000004), ref: 0042E40B
                                                                                                    • EnableWindow.USER32(00000000,00000000), ref: 0042E42F
                                                                                                    • ShowWindow.USER32(00481628,00000000), ref: 0042E48F
                                                                                                    • ShowWindow.USER32(00000000,00000004), ref: 0042E4A1
                                                                                                    • EnableWindow.USER32(00000000,00000001), ref: 0042E4C5
                                                                                                    • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0042E4E8
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$Show$Enable$MessageSend
                                                                                                    • String ID:
                                                                                                    • API String ID: 642888154-0
                                                                                                    • Opcode ID: 2c8823fd0aa3c21658f1667971eb259efb936f8f1c513f5826ce872dadbfb17d
                                                                                                    • Instruction ID: a8203b850bf92bf8d498d4985f9f377d48605d61e6d2f3d98855c2d76a23c7b2
                                                                                                    • Opcode Fuzzy Hash: 2c8823fd0aa3c21658f1667971eb259efb936f8f1c513f5826ce872dadbfb17d
                                                                                                    • Instruction Fuzzy Hash: B1418234701150EFDB22DF26D499F957BE1BF09304F9841BAEA588F2A2C735E842CB55
                                                                                                    Function 004098BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • InterlockedExchange.KERNEL32(?,000001F5), ref: 004098D1
                                                                                                      • Part of subcall function 003DF4EA: std::exception::exception.LIBCMT ref: 003DF51E
                                                                                                      • Part of subcall function 003DF4EA: __CxxThrowException@8.LIBCMT ref: 003DF533
                                                                                                    • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00409908
                                                                                                    • EnterCriticalSection.KERNEL32(?), ref: 00409924
                                                                                                    • LeaveCriticalSection.KERNEL32(?), ref: 0040999E
                                                                                                    • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 004099B3
                                                                                                    • InterlockedExchange.KERNEL32(?,000001F6), ref: 004099D2
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
                                                                                                    • String ID:
                                                                                                    • API String ID: 2537439066-0
                                                                                                    • Opcode ID: f53395c2db1d2959b303f09dddd27a11441061228b365373f44bc0aebfb728c4
                                                                                                    • Instruction ID: 666582a1abbbc563a216d3fdb72cbcde644f1fec680f99bb96120b715192decd
                                                                                                    • Opcode Fuzzy Hash: f53395c2db1d2959b303f09dddd27a11441061228b365373f44bc0aebfb728c4
                                                                                                    • Instruction Fuzzy Hash: C9316072900105ABDB01AF95DC85A6B7778FF85710B1440BAE905AF386D774DE10CBA4
                                                                                                    Function 00419B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetForegroundWindow.USER32(?,?,?,?,?,?,004177F4,?,?,00000000,00000001), ref: 00419B53
                                                                                                      • Part of subcall function 00416544: GetWindowRect.USER32(?,?), ref: 00416557
                                                                                                    • GetDesktopWindow.USER32 ref: 00419B7D
                                                                                                    • GetWindowRect.USER32(00000000), ref: 00419B84
                                                                                                    • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00419BB6
                                                                                                      • Part of subcall function 00407A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00407AD0
                                                                                                    • GetCursorPos.USER32(?), ref: 00419BE2
                                                                                                    • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00419C44
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                                    • String ID:
                                                                                                    • API String ID: 4137160315-0
                                                                                                    • Opcode ID: a613164964e205fe30c878ca69ecf2ec584128ae0874cb3cd1cb863766cf9d5a
                                                                                                    • Instruction ID: 297c9fcaa3375a12659f098f02d8e840f9815798030f7ef4d2aa269b533e5b93
                                                                                                    • Opcode Fuzzy Hash: a613164964e205fe30c878ca69ecf2ec584128ae0874cb3cd1cb863766cf9d5a
                                                                                                    • Instruction Fuzzy Hash: 5931D072608315ABC710DF14DC49F9BB7E9FF89318F00092AF595E7281DA35EA44CB96
                                                                                                    Function 003FAF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 003FAFAE
                                                                                                    • OpenProcessToken.ADVAPI32(00000000), ref: 003FAFB5
                                                                                                    • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 003FAFC4
                                                                                                    • CloseHandle.KERNEL32(00000004), ref: 003FAFCF
                                                                                                    • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 003FAFFE
                                                                                                    • DestroyEnvironmentBlock.USERENV(00000000), ref: 003FB012
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                    • String ID:
                                                                                                    • API String ID: 1413079979-0
                                                                                                    • Opcode ID: 9ab1ef562b87c315ce35aa67b36416dbc6435760137bc86627d5f44bc4d30ac0
                                                                                                    • Instruction ID: e31f5dd8116801d9c3077f31689e39a4715e8127c3d582310a94e2d8f30b330e
                                                                                                    • Opcode Fuzzy Hash: 9ab1ef562b87c315ce35aa67b36416dbc6435760137bc86627d5f44bc4d30ac0
                                                                                                    • Instruction Fuzzy Hash: E7218BB250430DAFCF028FA4DD09FAE7BA9EF49304F044025FE05A6161C3768D20EB61
                                                                                                    Function 0042EBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 003DAFE3
                                                                                                      • Part of subcall function 003DAF83: SelectObject.GDI32(?,00000000), ref: 003DAFF2
                                                                                                      • Part of subcall function 003DAF83: BeginPath.GDI32(?), ref: 003DB009
                                                                                                      • Part of subcall function 003DAF83: SelectObject.GDI32(?,00000000), ref: 003DB033
                                                                                                    • MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0042EC20
                                                                                                    • LineTo.GDI32(00000000,00000003,?), ref: 0042EC34
                                                                                                    • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0042EC42
                                                                                                    • LineTo.GDI32(00000000,00000000,?), ref: 0042EC52
                                                                                                    • EndPath.GDI32(00000000), ref: 0042EC62
                                                                                                    • StrokePath.GDI32(00000000), ref: 0042EC72
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                                                    • String ID:
                                                                                                    • API String ID: 43455801-0
                                                                                                    • Opcode ID: 13c6a01e5c6a031e66fc9a25fa9861bcce6b11dbf942327868916fd9ed2356eb
                                                                                                    • Instruction ID: b0d15c320d6478f8e70fe91294fa9d3d53a99c1afb43eff5cf2e49224bbbdc5c
                                                                                                    • Opcode Fuzzy Hash: 13c6a01e5c6a031e66fc9a25fa9861bcce6b11dbf942327868916fd9ed2356eb
                                                                                                    • Instruction Fuzzy Hash: 7B113576400148BFEB029FA0EC88EEA7F6DEF09354F048126BE089A160D7719D56DBA4
                                                                                                    Function 003FE19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetDC.USER32(00000000), ref: 003FE1C0
                                                                                                    • GetDeviceCaps.GDI32(00000000,00000058), ref: 003FE1D1
                                                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 003FE1D8
                                                                                                    • ReleaseDC.USER32(00000000,00000000), ref: 003FE1E0
                                                                                                    • MulDiv.KERNEL32(000009EC,?,00000000), ref: 003FE1F7
                                                                                                    • MulDiv.KERNEL32(000009EC,?,?), ref: 003FE209
                                                                                                      • Part of subcall function 003F9AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,003F9A05,00000000,00000000,?,003F9DDB), ref: 003FA53A
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CapsDevice$ExceptionRaiseRelease
                                                                                                    • String ID:
                                                                                                    • API String ID: 603618608-0
                                                                                                    • Opcode ID: 6846a70358c3ee230ac8f9da636d16eb77e263bb7b2fc46c2005fe4ef76006c8
                                                                                                    • Instruction ID: 423e1aab7549acd2d279942db478ade1bddfc8e2225ded6251d6ace3bc8c09ce
                                                                                                    • Opcode Fuzzy Hash: 6846a70358c3ee230ac8f9da636d16eb77e263bb7b2fc46c2005fe4ef76006c8
                                                                                                    • Instruction Fuzzy Hash: 15018FB9E00618BFEB109BA6CC45B5EBFB8EB49751F014066EE04AB390D6709C00CBA0
                                                                                                    Function 003E7B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __init_pointers.LIBCMT ref: 003E7B47
                                                                                                      • Part of subcall function 003E123A: __initp_misc_winsig.LIBCMT ref: 003E125E
                                                                                                      • Part of subcall function 003E123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 003E7F51
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 003E7F65
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 003E7F78
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 003E7F8B
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 003E7F9E
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 003E7FB1
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 003E7FC4
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 003E7FD7
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 003E7FEA
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 003E7FFD
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 003E8010
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 003E8023
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 003E8036
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 003E8049
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 003E805C
                                                                                                      • Part of subcall function 003E123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 003E806F
                                                                                                    • __mtinitlocks.LIBCMT ref: 003E7B4C
                                                                                                      • Part of subcall function 003E7E23: InitializeCriticalSectionAndSpinCount.KERNEL32(0047AC68,00000FA0,?,?,003E7B51,003E5E77,00476C70,00000014), ref: 003E7E41
                                                                                                    • __mtterm.LIBCMT ref: 003E7B55
                                                                                                      • Part of subcall function 003E7BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,003E7B5A,003E5E77,00476C70,00000014), ref: 003E7D3F
                                                                                                      • Part of subcall function 003E7BBD: _free.LIBCMT ref: 003E7D46
                                                                                                      • Part of subcall function 003E7BBD: DeleteCriticalSection.KERNEL32(0047AC68,?,?,003E7B5A,003E5E77,00476C70,00000014), ref: 003E7D68
                                                                                                    • __calloc_crt.LIBCMT ref: 003E7B7A
                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 003E7BA3
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
                                                                                                    • String ID:
                                                                                                    • API String ID: 2942034483-0
                                                                                                    • Opcode ID: fd7a372c65fc2a86e394c76f7c0e0474fbecf18f2ca85c89292819321db44d27
                                                                                                    • Instruction ID: 34a2c14365a4beaa7230ef896c231de66ac4d2fae3829c26eb6673e7d05df66a
                                                                                                    • Opcode Fuzzy Hash: fd7a372c65fc2a86e394c76f7c0e0474fbecf18f2ca85c89292819321db44d27
                                                                                                    • Instruction Fuzzy Hash: 9EF0B43251D3F319EA2777777C0BA8B26C59F42770B2107A9F864CD1D2FF2088424165
                                                                                                    Function 003C27EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • MapVirtualKeyW.USER32(0000005B,00000000), ref: 003C281D
                                                                                                    • MapVirtualKeyW.USER32(00000010,00000000), ref: 003C2825
                                                                                                    • MapVirtualKeyW.USER32(000000A0,00000000), ref: 003C2830
                                                                                                    • MapVirtualKeyW.USER32(000000A1,00000000), ref: 003C283B
                                                                                                    • MapVirtualKeyW.USER32(00000011,00000000), ref: 003C2843
                                                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 003C284B
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Virtual
                                                                                                    • String ID:
                                                                                                    • API String ID: 4278518827-0
                                                                                                    • Opcode ID: 03b6f7c4e7b89cb01895c419f0056517b5807989678b0e6ca7bdcc2d9b271602
                                                                                                    • Instruction ID: dbd51f7c94aaa595c96bec17f09f3ea1616151e8e71eedb6d93d86c0b9ff4f24
                                                                                                    • Opcode Fuzzy Hash: 03b6f7c4e7b89cb01895c419f0056517b5807989678b0e6ca7bdcc2d9b271602
                                                                                                    • Instruction Fuzzy Hash: 2F0167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C47A42C7F5A864CBE5
                                                                                                    Function 00409AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
                                                                                                    • String ID:
                                                                                                    • API String ID: 1423608774-0
                                                                                                    • Opcode ID: a4ebbf1bf7e3f8c56b1855a5ebcb4977cfb610c37dc6c1eab30581d91c0bd849
                                                                                                    • Instruction ID: 69e150b67743c9310877af360d086b908e9078ae3d04c361e3d6b7f0089e9c74
                                                                                                    • Opcode Fuzzy Hash: a4ebbf1bf7e3f8c56b1855a5ebcb4977cfb610c37dc6c1eab30581d91c0bd849
                                                                                                    • Instruction Fuzzy Hash: 3901A436702212ABDB191B58EC59DEB77A9FF89701B04057AF503A21E1DBB89C00DF58
                                                                                                    Function 00407BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00407C07
                                                                                                    • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00407C1D
                                                                                                    • GetWindowThreadProcessId.USER32(?,?), ref: 00407C2C
                                                                                                    • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00407C3B
                                                                                                    • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00407C45
                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00407C4C
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 839392675-0
                                                                                                    • Opcode ID: b70ed41396391994caa9d0d38c4758cab258d05c5f500edce2194871c7bc5306
                                                                                                    • Instruction ID: ff0deea0f5fe619ec95891d97b9e18e497fca40afe48e3e46d3119e71404117f
                                                                                                    • Opcode Fuzzy Hash: b70ed41396391994caa9d0d38c4758cab258d05c5f500edce2194871c7bc5306
                                                                                                    • Instruction Fuzzy Hash: 89F03A7AA42158BBE7215B529C0EEEF7B7CEFC7B11F000029FA05A1091D7A06A41C6B9
                                                                                                    Function 00409A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • InterlockedExchange.KERNEL32(?,?), ref: 00409A33
                                                                                                    • EnterCriticalSection.KERNEL32(?,?,?,?,00435DEE,?,?,?,?,?,003CED63), ref: 00409A44
                                                                                                    • TerminateThread.KERNEL32(?,000001F6,?,?,?,00435DEE,?,?,?,?,?,003CED63), ref: 00409A51
                                                                                                    • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00435DEE,?,?,?,?,?,003CED63), ref: 00409A5E
                                                                                                      • Part of subcall function 004093D1: CloseHandle.KERNEL32(?,?,00409A6B,?,?,?,00435DEE,?,?,?,?,?,003CED63), ref: 004093DB
                                                                                                    • InterlockedExchange.KERNEL32(?,000001F6), ref: 00409A71
                                                                                                    • LeaveCriticalSection.KERNEL32(?,?,?,?,00435DEE,?,?,?,?,?,003CED63), ref: 00409A78
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                    • String ID:
                                                                                                    • API String ID: 3495660284-0
                                                                                                    • Opcode ID: d6c1c82b9b55d4251d223317ac942b0a788a5fa78c0eec9bb5500aa47668ee16
                                                                                                    • Instruction ID: c2177d7438136ae812e778a93d165427bddc506766998ec371ad20f5e0c48f3d
                                                                                                    • Opcode Fuzzy Hash: d6c1c82b9b55d4251d223317ac942b0a788a5fa78c0eec9bb5500aa47668ee16
                                                                                                    • Instruction Fuzzy Hash: 6BF05E3AA41211ABD7111BA4EC89DAB7769FF8A301F140476F503A10A1DBB99801DB58
                                                                                                    Function 003C1CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DF4EA: std::exception::exception.LIBCMT ref: 003DF51E
                                                                                                      • Part of subcall function 003DF4EA: __CxxThrowException@8.LIBCMT ref: 003DF533
                                                                                                    • __swprintf.LIBCMT ref: 003C1EA6
                                                                                                    Strings
                                                                                                    • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 003C1D49
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Exception@8Throw__swprintfstd::exception::exception
                                                                                                    • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                                                    • API String ID: 2125237772-557222456
                                                                                                    • Opcode ID: 82696d0052a8ac9d6151c1dec2fca5c811e6921016f3ae11f6b73464e7bbf474
                                                                                                    • Instruction ID: 10e784bbefbe39d6502c4875011c5674f083dc9eccc59abd4fe4a9839916558b
                                                                                                    • Opcode Fuzzy Hash: 82696d0052a8ac9d6151c1dec2fca5c811e6921016f3ae11f6b73464e7bbf474
                                                                                                    • Instruction Fuzzy Hash: 05917D72104211AFC716EF24C896E6FB7A4BF99700F04491EF895DB2A2DB70ED05CB96
                                                                                                    Function 0041AFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • VariantInit.OLEAUT32(?), ref: 0041B006
                                                                                                    • CharUpperBuffW.USER32(?,?), ref: 0041B115
                                                                                                    • VariantClear.OLEAUT32(?), ref: 0041B298
                                                                                                      • Part of subcall function 00409DC5: VariantInit.OLEAUT32(00000000), ref: 00409E05
                                                                                                      • Part of subcall function 00409DC5: VariantCopy.OLEAUT32(?,?), ref: 00409E0E
                                                                                                      • Part of subcall function 00409DC5: VariantClear.OLEAUT32(?), ref: 00409E1A
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                                                                    • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                                                    • API String ID: 4237274167-1221869570
                                                                                                    • Opcode ID: 3eba69cb5e5daece341845c2f013c1484fe8e0cc8904f0bc98485c860f1369ee
                                                                                                    • Instruction ID: 1eb1ffffa3110ee3c5ed4c3d17dc1b834eb612148e5a643c294c8c599e781e37
                                                                                                    • Opcode Fuzzy Hash: 3eba69cb5e5daece341845c2f013c1484fe8e0cc8904f0bc98485c860f1369ee
                                                                                                    • Instruction Fuzzy Hash: 79916A746043019FCB10DF24C485A9BBBE4EF89744F04486EF89A9B362DB35ED45CB96
                                                                                                    Function 00405347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DC6F4: _wcscpy.LIBCMT ref: 003DC717
                                                                                                    • _memset.LIBCMT ref: 00405438
                                                                                                    • GetMenuItemInfoW.USER32(?), ref: 00405467
                                                                                                    • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00405513
                                                                                                    • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0040553D
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                                                                    • String ID: 0
                                                                                                    • API String ID: 4152858687-4108050209
                                                                                                    • Opcode ID: 28f5f0b52502a3e625ba4bacdb28c523bc620a854185eff01c1e12339312f959
                                                                                                    • Instruction ID: 70ef3861c3f3a27f9695bbf2e5234c0276ed1e3d58fd7e669728b8a09a41e2c8
                                                                                                    • Opcode Fuzzy Hash: 28f5f0b52502a3e625ba4bacdb28c523bc620a854185eff01c1e12339312f959
                                                                                                    • Instruction Fuzzy Hash: 4451FE71504601AAD715AB28CC45BABB6E8EB85314F040A3FF895E72E0DBB8CD418F5A
                                                                                                    Function 00400213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0040027B
                                                                                                    • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 004002B1
                                                                                                    • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 004002C2
                                                                                                    • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00400344
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorMode$AddressCreateInstanceProc
                                                                                                    • String ID: DllGetClassObject
                                                                                                    • API String ID: 753597075-1075368562
                                                                                                    • Opcode ID: 674019b89f330f688d5926a926e0d1cfb9e2ed2f3b33a0020fe37728a3ecc7d2
                                                                                                    • Instruction ID: 80cde16a9d096706f5c7c9c56058136158218e86f20130f441b0f76f3434ccc8
                                                                                                    • Opcode Fuzzy Hash: 674019b89f330f688d5926a926e0d1cfb9e2ed2f3b33a0020fe37728a3ecc7d2
                                                                                                    • Instruction Fuzzy Hash: 5C414171600204DFDB06DF54C884B9A7BB9EF45315F1480BEED09AF286D7B9DA44CBA8
                                                                                                    Function 00405007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 00405075
                                                                                                    • GetMenuItemInfoW.USER32 ref: 00405091
                                                                                                    • DeleteMenu.USER32(00000004,00000007,00000000), ref: 004050D7
                                                                                                    • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00481708,00000000), ref: 00405120
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Menu$Delete$InfoItem_memset
                                                                                                    • String ID: 0
                                                                                                    • API String ID: 1173514356-4108050209
                                                                                                    • Opcode ID: a59ec2bfa49dbc710f0e0ee0896e6414eeb543d7ca4ba2f6e680f6b746a9614a
                                                                                                    • Instruction ID: 8f8a96ee8680d590a889dbb3ffe436c966926e0ba13794e32ed61458ab22fbf0
                                                                                                    • Opcode Fuzzy Hash: a59ec2bfa49dbc710f0e0ee0896e6414eeb543d7ca4ba2f6e680f6b746a9614a
                                                                                                    • Instruction Fuzzy Hash: 4241AE716057019FD7209F24D885B2BB7E8EF85318F044A2EF965AB3D1D774A900CF6A
                                                                                                    Function 00420567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CharLowerBuffW.USER32(?,?,?,?), ref: 00420587
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: BuffCharLower
                                                                                                    • String ID: cdecl$none$stdcall$winapi
                                                                                                    • API String ID: 2358735015-567219261
                                                                                                    • Opcode ID: 0e0d4d1efefd7d0eb37e3abfd977fa7715fc26d272bdf82658e6841e6fa880c7
                                                                                                    • Instruction ID: 2c65e1897ac50e017319ed7b6f8ec9644aba945b2c088fe18c7061c9a817fcd3
                                                                                                    • Opcode Fuzzy Hash: 0e0d4d1efefd7d0eb37e3abfd977fa7715fc26d272bdf82658e6841e6fa880c7
                                                                                                    • Instruction Fuzzy Hash: 9031C131600216AFCF01EF54DD41AEEB3B4FF45314B50862AE426AB3D2DB75AD06CB84
                                                                                                    Function 003FB80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 003FB88E
                                                                                                    • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 003FB8A1
                                                                                                    • SendMessageW.USER32(?,00000189,?,00000000), ref: 003FB8D1
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend
                                                                                                    • String ID: ComboBox$ListBox
                                                                                                    • API String ID: 3850602802-1403004172
                                                                                                    • Opcode ID: eaa0c652aa93db8d79275c569c33230999823eed78c65d2d1380f3fe59ad69b8
                                                                                                    • Instruction ID: 3e4f7b16d4823bcb5fa903913a61185393e67269a1a201da8e93731aa14a449e
                                                                                                    • Opcode Fuzzy Hash: eaa0c652aa93db8d79275c569c33230999823eed78c65d2d1380f3fe59ad69b8
                                                                                                    • Instruction Fuzzy Hash: DE2107B6A00108BFD7069BB4D886EFEB77CDF46350B10412DF115AB1E1DB744D069760
                                                                                                    Function 004143E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00414401
                                                                                                    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00414427
                                                                                                    • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00414457
                                                                                                    • InternetCloseHandle.WININET(00000000), ref: 0041449E
                                                                                                      • Part of subcall function 00415052: GetLastError.KERNEL32(?,?,004143CC,00000000,00000000,00000001), ref: 00415067
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
                                                                                                    • String ID:
                                                                                                    • API String ID: 1951874230-3916222277
                                                                                                    • Opcode ID: e11701be8768187952c40cd7a8a9c3d86dadf4507c4b0772cb1ae65536cc118c
                                                                                                    • Instruction ID: b8184186e7b24e154d457c12def7af3a18390452b51f3d8f59b494d92eaa2a5d
                                                                                                    • Opcode Fuzzy Hash: e11701be8768187952c40cd7a8a9c3d86dadf4507c4b0772cb1ae65536cc118c
                                                                                                    • Instruction Fuzzy Hash: E121B0B5540208BEE7119F95CC84FFBBAECEB89758F10802BF10992240DA689D459779
                                                                                                    Function 004290E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 003DD1BA
                                                                                                      • Part of subcall function 003DD17C: GetStockObject.GDI32(00000011), ref: 003DD1CE
                                                                                                      • Part of subcall function 003DD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 003DD1D8
                                                                                                    • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 0042915C
                                                                                                    • LoadLibraryW.KERNEL32(?), ref: 00429163
                                                                                                    • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00429178
                                                                                                    • DestroyWindow.USER32(?), ref: 00429180
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                                                                    • String ID: SysAnimate32
                                                                                                    • API String ID: 4146253029-1011021900
                                                                                                    • Opcode ID: fb1e8dc4d8ffb6d76b187e0f2804c4beca3bfaa814d8979c75c61c09705ee472
                                                                                                    • Instruction ID: 2c8a7b8748014d053c702ed99c36dbb527f178ab7588dafaf7d97f3e261e1b0d
                                                                                                    • Opcode Fuzzy Hash: fb1e8dc4d8ffb6d76b187e0f2804c4beca3bfaa814d8979c75c61c09705ee472
                                                                                                    • Instruction Fuzzy Hash: 2D21DE71300216BBFF104F66AC84EBB33ADFB99364F50022AF91492290C735CC62A768
                                                                                                    Function 00409568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetStdHandle.KERNEL32(0000000C), ref: 00409588
                                                                                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 004095B9
                                                                                                    • GetStdHandle.KERNEL32(0000000C), ref: 004095CB
                                                                                                    • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00409605
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CreateHandle$FilePipe
                                                                                                    • String ID: nul
                                                                                                    • API String ID: 4209266947-2873401336
                                                                                                    • Opcode ID: 2e48b1e02bdf0aff354e9de9415bde8f0a41448acbced52918d69515529bdb1d
                                                                                                    • Instruction ID: 74bf3071089be0e4d4fdd340dd8136ffda1d0da4eb35d655e6c5929e240edf46
                                                                                                    • Opcode Fuzzy Hash: 2e48b1e02bdf0aff354e9de9415bde8f0a41448acbced52918d69515529bdb1d
                                                                                                    • Instruction Fuzzy Hash: 87219075600205ABDB219F26DC05A9A7BF8BF85724F204A3AFCA1E72D1D774DD41CB18
                                                                                                    Function 00409634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetStdHandle.KERNEL32(000000F6), ref: 00409653
                                                                                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00409683
                                                                                                    • GetStdHandle.KERNEL32(000000F6), ref: 00409694
                                                                                                    • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 004096CE
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CreateHandle$FilePipe
                                                                                                    • String ID: nul
                                                                                                    • API String ID: 4209266947-2873401336
                                                                                                    • Opcode ID: dcc691dcb156d02ad219a8a20c0d126cdb1d7048bab16d8680d6a5cb55f5affc
                                                                                                    • Instruction ID: b81362b7e5afa11f2fcaa458f52c7dacd568f8ab51b0ff2f851c5f11f1b02500
                                                                                                    • Opcode Fuzzy Hash: dcc691dcb156d02ad219a8a20c0d126cdb1d7048bab16d8680d6a5cb55f5affc
                                                                                                    • Instruction Fuzzy Hash: AE21A1716002059BDB209F799C04E9A77E8AF45724F200E2AFCA1F33D1D7B59C41CB18
                                                                                                    Function 0040DAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0040DB0A
                                                                                                    • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0040DB5E
                                                                                                    • __swprintf.LIBCMT ref: 0040DB77
                                                                                                    • SetErrorMode.KERNEL32(00000000,00000001,00000000,0045DC00), ref: 0040DBB5
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorMode$InformationVolume__swprintf
                                                                                                    • String ID: %lu
                                                                                                    • API String ID: 3164766367-685833217
                                                                                                    • Opcode ID: df2da6badb5c41fec6cf67fab8f31531c3a13d5c94bc1b0a12c32c248d97674c
                                                                                                    • Instruction ID: 9b3cbf11b6af0bb0549bc509c8935535f331c84dd6cc2f52e86647127f917001
                                                                                                    • Opcode Fuzzy Hash: df2da6badb5c41fec6cf67fab8f31531c3a13d5c94bc1b0a12c32c248d97674c
                                                                                                    • Instruction Fuzzy Hash: AE219835A00108AFCB11EF95CD85E9EBBB8EF49704B104079F509EB291DB74EE45CB65
                                                                                                    Function 003FC9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003FC82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 003FC84A
                                                                                                      • Part of subcall function 003FC82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 003FC85D
                                                                                                      • Part of subcall function 003FC82D: GetCurrentThreadId.KERNEL32 ref: 003FC864
                                                                                                      • Part of subcall function 003FC82D: AttachThreadInput.USER32(00000000), ref: 003FC86B
                                                                                                    • GetFocus.USER32 ref: 003FCA05
                                                                                                      • Part of subcall function 003FC876: GetParent.USER32(?), ref: 003FC884
                                                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 003FCA4E
                                                                                                    • EnumChildWindows.USER32(?,003FCAC4), ref: 003FCA76
                                                                                                    • __swprintf.LIBCMT ref: 003FCA90
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
                                                                                                    • String ID: %s%d
                                                                                                    • API String ID: 3187004680-1110647743
                                                                                                    • Opcode ID: 85b8330df22716d9e6138cb3ba80a21cdab453b6465c7ed265f1716d4dfefec9
                                                                                                    • Instruction ID: 9bcb5238aceaeed6170bc0407e78d0b0d92d11ae3b7fa68c5fea1ee5a353623d
                                                                                                    • Opcode Fuzzy Hash: 85b8330df22716d9e6138cb3ba80a21cdab453b6465c7ed265f1716d4dfefec9
                                                                                                    • Instruction Fuzzy Hash: B2119DB565020D6BCF12BFA09D86FF93768AF44714F00906AFF09AA182CB70A945CB70
                                                                                                    Function 003E7A94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __lock.LIBCMT ref: 003E7AD8
                                                                                                      • Part of subcall function 003E7CF4: __mtinitlocknum.LIBCMT ref: 003E7D06
                                                                                                      • Part of subcall function 003E7CF4: EnterCriticalSection.KERNEL32(00000000,?,003E7ADD,0000000D), ref: 003E7D1F
                                                                                                    • InterlockedIncrement.KERNEL32(?), ref: 003E7AE5
                                                                                                    • __lock.LIBCMT ref: 003E7AF9
                                                                                                    • ___addlocaleref.LIBCMT ref: 003E7B17
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
                                                                                                    • String ID: `D
                                                                                                    • API String ID: 1687444384-1070873967
                                                                                                    • Opcode ID: cf8dc9723c3bf4241f9ed55ecf0face672e95b1903ac18421c780e633294b9b5
                                                                                                    • Instruction ID: 05d4be8ad68ed6a7e888f453b3d1cd5352cf4e6c508bf9148ff392e8e7504f93
                                                                                                    • Opcode Fuzzy Hash: cf8dc9723c3bf4241f9ed55ecf0face672e95b1903ac18421c780e633294b9b5
                                                                                                    • Instruction Fuzzy Hash: BF016D71404B41EFD732DF76C90674AB7F0AF50321F208A0EA49A9B2E1CBB4A681CB05
                                                                                                    Function 0042E32E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40processCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 0042E33D
                                                                                                    • _memset.LIBCMT ref: 0042E34C
                                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00483D00,00483D44), ref: 0042E37B
                                                                                                    • CloseHandle.KERNEL32 ref: 0042E38D
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _memset$CloseCreateHandleProcess
                                                                                                    • String ID: D=H
                                                                                                    • API String ID: 3277943733-2587720978
                                                                                                    • Opcode ID: affafa29ea6604bf362dd8efadc8cca9b9e92f19711d48cbefc9c3cb3f0a63b9
                                                                                                    • Instruction ID: 3a91944a348e37062de8f0ef318217af78919c6515a4da02a7a6ed909c79c819
                                                                                                    • Opcode Fuzzy Hash: affafa29ea6604bf362dd8efadc8cca9b9e92f19711d48cbefc9c3cb3f0a63b9
                                                                                                    • Instruction Fuzzy Hash: 0BF05EF1640314BAE6116FA5AC45F7B7E9CDB05F56F004835FE08DA1A2D3B99E0087AC
                                                                                                    Function 00421945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 004219F3
                                                                                                    • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00421A26
                                                                                                    • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00421B49
                                                                                                    • CloseHandle.KERNEL32(?), ref: 00421BBF
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                                                                    • String ID:
                                                                                                    • API String ID: 2364364464-0
                                                                                                    • Opcode ID: e1864f1a0c560dd6bf8be29f88bfe70bb0bc147919cf95f1881af7bdd141575c
                                                                                                    • Instruction ID: 529d648a0ea97c69a6fa72117397cb3a451e58e19667baea9d1a13b9893e6abc
                                                                                                    • Opcode Fuzzy Hash: e1864f1a0c560dd6bf8be29f88bfe70bb0bc147919cf95f1881af7bdd141575c
                                                                                                    • Instruction Fuzzy Hash: D581A375700210ABDF119F64D886BAEBBF5AF08720F04845AF905AF392D7B8AD41CB94
                                                                                                    Function 0042E062 Relevance: 7.7, APIs: 5, Instructions: 187windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0042E1D5
                                                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0042E20D
                                                                                                    • IsDlgButtonChecked.USER32(?,00000001), ref: 0042E248
                                                                                                    • GetWindowLongW.USER32(?,000000EC), ref: 0042E269
                                                                                                    • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0042E281
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$ButtonCheckedLongWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 3188977179-0
                                                                                                    • Opcode ID: c1d845f4ae30c65270591d83d7ee3841328362ddd1b3e32aa94799ed37333c93
                                                                                                    • Instruction ID: 81ec355014894872410e10fd0712a2117a1b322287f925379d1c58dc6634560e
                                                                                                    • Opcode Fuzzy Hash: c1d845f4ae30c65270591d83d7ee3841328362ddd1b3e32aa94799ed37333c93
                                                                                                    • Instruction Fuzzy Hash: A461A034B00224AFDB25CF56D850FBF77BAAB49300F48446BE859973A1C778AD51CB19
                                                                                                    Function 00401C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • VariantInit.OLEAUT32(?), ref: 00401CB4
                                                                                                    • VariantClear.OLEAUT32(00000013), ref: 00401D26
                                                                                                    • VariantClear.OLEAUT32(00000000), ref: 00401D81
                                                                                                    • VariantClear.OLEAUT32(?), ref: 00401DF8
                                                                                                    • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00401E26
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Variant$Clear$ChangeInitType
                                                                                                    • String ID:
                                                                                                    • API String ID: 4136290138-0
                                                                                                    • Opcode ID: 5eec2683534d18ead58ccddb5b169e68e7487617c91af95238687c704e9c5e5c
                                                                                                    • Instruction ID: f9408fd82db64b3e1045f3754cd89ffa45a7f395abea1ccf637038e4bf40f67a
                                                                                                    • Opcode Fuzzy Hash: 5eec2683534d18ead58ccddb5b169e68e7487617c91af95238687c704e9c5e5c
                                                                                                    • Instruction Fuzzy Hash: 4C516AB5A00209EFCB14CF58C880AAAB7B9FF4D314B15856AE949EB350D334E951CFA4
                                                                                                    Function 00420688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C936C: __swprintf.LIBCMT ref: 003C93AB
                                                                                                      • Part of subcall function 003C936C: __itow.LIBCMT ref: 003C93DF
                                                                                                    • LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 004206EE
                                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 0042077D
                                                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0042079B
                                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 004207E1
                                                                                                    • FreeLibrary.KERNEL32(00000000,00000004), ref: 004207FB
                                                                                                      • Part of subcall function 003DE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0040A574,?,?,00000000,00000008), ref: 003DE675
                                                                                                      • Part of subcall function 003DE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0040A574,?,?,00000000,00000008), ref: 003DE699
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                                                                    • String ID:
                                                                                                    • API String ID: 327935632-0
                                                                                                    • Opcode ID: b10803cc4b2438d94b8e00906e70c04086d2085e5b69787d6aa42214309f56d8
                                                                                                    • Instruction ID: d00ed3e8cf64721ef5d40890d999fa767ab47a30a8a821e9716ad6aaa8724823
                                                                                                    • Opcode Fuzzy Hash: b10803cc4b2438d94b8e00906e70c04086d2085e5b69787d6aa42214309f56d8
                                                                                                    • Instruction Fuzzy Hash: FB516B76A00215DFCB01EFA8D485EAEB7F5BF49310B04806AF915AB352DB34ED41CB44
                                                                                                    Function 00422E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 00423C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00422BB5,?,?), ref: 00423C1D
                                                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00422EEF
                                                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00422F2E
                                                                                                    • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00422F75
                                                                                                    • RegCloseKey.ADVAPI32(?,?), ref: 00422FA1
                                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 00422FAE
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Close$BuffCharConnectEnumOpenRegistryUpper
                                                                                                    • String ID:
                                                                                                    • API String ID: 3740051246-0
                                                                                                    • Opcode ID: 863c5032ff32ca5e71f0e13c768cefc601dbed2a325db0c73b96f64976b7de92
                                                                                                    • Instruction ID: 3a292f42af4b75042f0f063f2f1a4e6c5670e2720b7af21190dffb648c7480b4
                                                                                                    • Opcode Fuzzy Hash: 863c5032ff32ca5e71f0e13c768cefc601dbed2a325db0c73b96f64976b7de92
                                                                                                    • Instruction Fuzzy Hash: 46516632208204AFC705EF64C981F6AB7F8BF88304F44882EF5959B2A1DB74ED05DB56
                                                                                                    Function 0042CCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: bc572a67d09c530c9a14ee7252a97a22036481658661fda51c478753a0d1c9cf
                                                                                                    • Instruction ID: 37c171b6851c942e28297dab68d948f3b145b41ef6f449e65069ddd78c5b5ec2
                                                                                                    • Opcode Fuzzy Hash: bc572a67d09c530c9a14ee7252a97a22036481658661fda51c478753a0d1c9cf
                                                                                                    • Instruction Fuzzy Hash: 0341D639F10124ABC710DB68DC84FAEBB68EB09350F550276F959A72E1C778AD02D658
                                                                                                    Function 00411206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 004112B4
                                                                                                    • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 004112DD
                                                                                                    • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0041131C
                                                                                                      • Part of subcall function 003C936C: __swprintf.LIBCMT ref: 003C93AB
                                                                                                      • Part of subcall function 003C936C: __itow.LIBCMT ref: 003C93DF
                                                                                                    • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00411341
                                                                                                    • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00411349
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                                                                    • String ID:
                                                                                                    • API String ID: 1389676194-0
                                                                                                    • Opcode ID: ccbe7998eb03928c0e03765fe4314e80d1f8d07865def8b6887e0c9ab4c3949f
                                                                                                    • Instruction ID: 1e7cdd98872ce4f8c09879eecea93f56de5d68189430dc52a8e9e98dfcb3d9d2
                                                                                                    • Opcode Fuzzy Hash: ccbe7998eb03928c0e03765fe4314e80d1f8d07865def8b6887e0c9ab4c3949f
                                                                                                    • Instruction Fuzzy Hash: 71410839A00505DFDB01EF64C985AAEBBF5FF48310B1480A9E90AAB361CB35ED41CB54
                                                                                                    Function 003DB63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetCursorPos.USER32(000000FF), ref: 003DB64F
                                                                                                    • ScreenToClient.USER32(00000000,000000FF), ref: 003DB66C
                                                                                                    • GetAsyncKeyState.USER32(00000001), ref: 003DB691
                                                                                                    • GetAsyncKeyState.USER32(00000002), ref: 003DB69F
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AsyncState$ClientCursorScreen
                                                                                                    • String ID:
                                                                                                    • API String ID: 4210589936-0
                                                                                                    • Opcode ID: e1f5b81979d4a3b293f6137f3c8a931eefbabfd0e9a5ea2eb8b3f86c2ab071c5
                                                                                                    • Instruction ID: 2f2123c0086fbd6c511f4bf756bbb29d523bf7da32875134af554927f6f72fb5
                                                                                                    • Opcode Fuzzy Hash: e1f5b81979d4a3b293f6137f3c8a931eefbabfd0e9a5ea2eb8b3f86c2ab071c5
                                                                                                    • Instruction Fuzzy Hash: 70419E35A04115FBDF169F64D884AEDFB74BB09324F11431BF82996290CB34A990DF95
                                                                                                    Function 003FB358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetWindowRect.USER32(?,?), ref: 003FB369
                                                                                                    • PostMessageW.USER32(?,00000201,00000001), ref: 003FB413
                                                                                                    • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 003FB41B
                                                                                                    • PostMessageW.USER32(?,00000202,00000000), ref: 003FB429
                                                                                                    • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 003FB431
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessagePostSleep$RectWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 3382505437-0
                                                                                                    • Opcode ID: be1d5702a9b336a49360fa4ba22a351648195156c2b35c07533ac425d70abaf2
                                                                                                    • Instruction ID: 5dc4251795ab9d37c2ab22c99493f5e7c7cf9c0abd3c1563292bac70649bd898
                                                                                                    • Opcode Fuzzy Hash: be1d5702a9b336a49360fa4ba22a351648195156c2b35c07533ac425d70abaf2
                                                                                                    • Instruction Fuzzy Hash: 6231CEB590021DEBDF04CFA8D94DAAEBBB5EB05315F114229FA25AA1D1C3B09914CB90
                                                                                                    Function 003FDBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • IsWindowVisible.USER32(?), ref: 003FDBD7
                                                                                                    • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 003FDBF4
                                                                                                    • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 003FDC2C
                                                                                                    • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 003FDC52
                                                                                                    • _wcsstr.LIBCMT ref: 003FDC5C
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                                                                    • String ID:
                                                                                                    • API String ID: 3902887630-0
                                                                                                    • Opcode ID: c0f5b55c407379d2158f7d8133b68428a65f7ab7821ef1e0fcd4b7b54c78ad25
                                                                                                    • Instruction ID: eba27bba9d26e2e623725f660a1056efa47586b1b3960d3b40ae76d58b8a4b2f
                                                                                                    • Opcode Fuzzy Hash: c0f5b55c407379d2158f7d8133b68428a65f7ab7821ef1e0fcd4b7b54c78ad25
                                                                                                    • Instruction Fuzzy Hash: 67212972604148BBEB169F39AC4DE7B7BADDF46750F11403AF90ACE191EAA1CC41D260
                                                                                                    Function 003FBC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 003FBC90
                                                                                                    • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 003FBCC2
                                                                                                    • __itow.LIBCMT ref: 003FBCDA
                                                                                                    • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 003FBD00
                                                                                                    • __itow.LIBCMT ref: 003FBD11
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$__itow
                                                                                                    • String ID:
                                                                                                    • API String ID: 3379773720-0
                                                                                                    • Opcode ID: 54430b847fbe24378216c6d49b2538d9c30fb21b72c74765f62c447ef8713743
                                                                                                    • Instruction ID: 2fe1b8215ced6dba085fc2ade34a576e7c6f7485586e5abaf2c94d263c18db22
                                                                                                    • Opcode Fuzzy Hash: 54430b847fbe24378216c6d49b2538d9c30fb21b72c74765f62c447ef8713743
                                                                                                    • Instruction Fuzzy Hash: 9F21A4B570021CAADB12AE65CC46FEFBA6CAF5A710F110029FB05EF181DB748D4587A1
                                                                                                    Function 00406318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C50E6: _wcsncpy.LIBCMT ref: 003C50FA
                                                                                                    • GetFileAttributesW.KERNEL32(?,?,?,?,004060C3), ref: 00406369
                                                                                                    • GetLastError.KERNEL32(?,?,?,004060C3), ref: 00406374
                                                                                                    • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,004060C3), ref: 00406388
                                                                                                    • _wcsrchr.LIBCMT ref: 004063AA
                                                                                                      • Part of subcall function 00406318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,004060C3), ref: 004063E0
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
                                                                                                    • String ID:
                                                                                                    • API String ID: 3633006590-0
                                                                                                    • Opcode ID: af11b7a9699ed39cec0d4022fbc857602a911a4e530ff1d932309891d9b09909
                                                                                                    • Instruction ID: bd756fe91fcfb10ffb4c243837ba9585136a1a6f85e8e8fbc4a03b25491d5c9f
                                                                                                    • Opcode Fuzzy Hash: af11b7a9699ed39cec0d4022fbc857602a911a4e530ff1d932309891d9b09909
                                                                                                    • Instruction Fuzzy Hash: 2C21DB319042155ADB16AB74AC42FEB235CEF06350F11047BF947E72C0EBB4D9919AA9
                                                                                                    Function 00418B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 0041A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 0041A84E
                                                                                                    • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00418BD3
                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00418BE2
                                                                                                    • connect.WSOCK32(00000000,?,00000010), ref: 00418BFE
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorLastconnectinet_addrsocket
                                                                                                    • String ID:
                                                                                                    • API String ID: 3701255441-0
                                                                                                    • Opcode ID: 4b185e0876d70233760fb1191105ee3d585ea2e9752d4f3573147c873ae4f32d
                                                                                                    • Instruction ID: 44c3d29dcfcc6de98a78e4e0b0a676953a411be82df523d5d6aa8e4af381ab9e
                                                                                                    • Opcode Fuzzy Hash: 4b185e0876d70233760fb1191105ee3d585ea2e9752d4f3573147c873ae4f32d
                                                                                                    • Instruction Fuzzy Hash: 9D21DE326002009FCB10EF28CD85FBE73A9AF49310F04442EF902AB3D2CB78AC418B65
                                                                                                    Function 00418420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • IsWindow.USER32(00000000), ref: 00418441
                                                                                                    • GetForegroundWindow.USER32 ref: 00418458
                                                                                                    • GetDC.USER32(00000000), ref: 00418494
                                                                                                    • GetPixel.GDI32(00000000,?,00000003), ref: 004184A0
                                                                                                    • ReleaseDC.USER32(00000000,00000003), ref: 004184DB
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$ForegroundPixelRelease
                                                                                                    • String ID:
                                                                                                    • API String ID: 4156661090-0
                                                                                                    • Opcode ID: 6ebb17195c8601c5852093b3f6636862aedbf72461ce38b75e7858b2b3328b08
                                                                                                    • Instruction ID: 9fb9f3bd9c54d2b6ecafefd4ea76c1e11fd5a47b86819d827fe826e9007240c2
                                                                                                    • Opcode Fuzzy Hash: 6ebb17195c8601c5852093b3f6636862aedbf72461ce38b75e7858b2b3328b08
                                                                                                    • Instruction Fuzzy Hash: 15219F36A00204AFD700DFA4DC84AAEBBE5EF49301F04887DE84997351DE74AC40CBA4
                                                                                                    Function 003DAF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 003DAFE3
                                                                                                    • SelectObject.GDI32(?,00000000), ref: 003DAFF2
                                                                                                    • BeginPath.GDI32(?), ref: 003DB009
                                                                                                    • SelectObject.GDI32(?,00000000), ref: 003DB033
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ObjectSelect$BeginCreatePath
                                                                                                    • String ID:
                                                                                                    • API String ID: 3225163088-0
                                                                                                    • Opcode ID: 5a010d7445112d50390bc2904397e131b6403ed727cd2d2ac7ba231f4257a4e3
                                                                                                    • Instruction ID: abe9796a2beea5b90bbe9fba1a1007d4fc4a013f0bcf8fd304dcde256585a72f
                                                                                                    • Opcode Fuzzy Hash: 5a010d7445112d50390bc2904397e131b6403ed727cd2d2ac7ba231f4257a4e3
                                                                                                    • Instruction Fuzzy Hash: 832190B2C00205EFDB129F55EC8479E7B6CBB10355F15462FE861A22B0E37048468B98
                                                                                                    Function 003E217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __calloc_crt.LIBCMT ref: 003E21A9
                                                                                                    • CreateThread.KERNEL32(?,?,003E22DF,00000000,?,?), ref: 003E21ED
                                                                                                    • GetLastError.KERNEL32 ref: 003E21F7
                                                                                                    • _free.LIBCMT ref: 003E2200
                                                                                                    • __dosmaperr.LIBCMT ref: 003E220B
                                                                                                      • Part of subcall function 003E7C0E: __getptd_noexit.LIBCMT ref: 003E7C0E
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
                                                                                                    • String ID:
                                                                                                    • API String ID: 2664167353-0
                                                                                                    • Opcode ID: ddb0fc60455b983bdddb9a6745543b2c06ce91e17f22ad4e5ecc7256f3227846
                                                                                                    • Instruction ID: 9ef68b5a4db0531a682549be7910fd365f8d74a4d5e6b4ed0e349a220646fd90
                                                                                                    • Opcode Fuzzy Hash: ddb0fc60455b983bdddb9a6745543b2c06ce91e17f22ad4e5ecc7256f3227846
                                                                                                    • Instruction Fuzzy Hash: 5311C8321043E6AFDB13AF67DC42DAB779CEF45770B110629FA148A1D1DB71D81187A1
                                                                                                    Function 003FABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 003FABD7
                                                                                                    • GetLastError.KERNEL32(?,003FA69F,?,?,?), ref: 003FABE1
                                                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,003FA69F,?,?,?), ref: 003FABF0
                                                                                                    • HeapAlloc.KERNEL32(00000000,?,003FA69F,?,?,?), ref: 003FABF7
                                                                                                    • GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 003FAC0E
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                                                    • String ID:
                                                                                                    • API String ID: 842720411-0
                                                                                                    • Opcode ID: c311cf25abfbdd7986a6e96bdf7d5fa19e2b3dbc25d6b796a6b0c15fdad6b12f
                                                                                                    • Instruction ID: ef180280277a07c6f1eeb56e46f089f4826efb1c49e5542a293d1b81c9daceee
                                                                                                    • Opcode Fuzzy Hash: c311cf25abfbdd7986a6e96bdf7d5fa19e2b3dbc25d6b796a6b0c15fdad6b12f
                                                                                                    • Instruction Fuzzy Hash: B9013CB5600208BFDB114FA9DC48DAB3BADEF8A7557110479F949C3260DA71DC40CB65
                                                                                                    Function 00407A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00407A74
                                                                                                    • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00407A82
                                                                                                    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00407A8A
                                                                                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00407A94
                                                                                                    • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00407AD0
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                    • String ID:
                                                                                                    • API String ID: 2833360925-0
                                                                                                    • Opcode ID: 1f6b3209b783be0a7c048b1ebbc261f4ac42ded7543690ff91f904838e73174d
                                                                                                    • Instruction ID: 3cb37501acbea7ea2cdf6d4774910cc090f00b9485d13fd13fc3e2759162fada
                                                                                                    • Opcode Fuzzy Hash: 1f6b3209b783be0a7c048b1ebbc261f4ac42ded7543690ff91f904838e73174d
                                                                                                    • Instruction Fuzzy Hash: 40014075E04619DBCF00AFE5DD48ADDBB78FF09711F004566D902B2290DB78AA50CBAA
                                                                                                    Function 003F9ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CLSIDFromProgID.OLE32 ref: 003F9ADC
                                                                                                    • ProgIDFromCLSID.OLE32(?,00000000), ref: 003F9AF7
                                                                                                    • lstrcmpiW.KERNEL32(?,00000000), ref: 003F9B05
                                                                                                    • CoTaskMemFree.OLE32(00000000,?,00000000), ref: 003F9B15
                                                                                                    • CLSIDFromString.OLE32(?,?), ref: 003F9B21
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                                                    • String ID:
                                                                                                    • API String ID: 3897988419-0
                                                                                                    • Opcode ID: db070990e46180219292b64dae8b9378e2d3455ffe55a18a0a720a4778ab83c5
                                                                                                    • Instruction ID: 2206ef07a44a6beffa172850945c0a82c1d3628a8c16557b021e87032416ebf7
                                                                                                    • Opcode Fuzzy Hash: db070990e46180219292b64dae8b9378e2d3455ffe55a18a0a720a4778ab83c5
                                                                                                    • Instruction Fuzzy Hash: 4E018F7AA00219BFDB125F54EC44BBEBAEDEB49352F144036FA05D6210D770DD409BA0
                                                                                                    Function 003FAA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003FAA79
                                                                                                    • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003FAA83
                                                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003FAA92
                                                                                                    • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003FAA99
                                                                                                    • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003FAAAF
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                                    • String ID:
                                                                                                    • API String ID: 44706859-0
                                                                                                    • Opcode ID: 35b678d50e37562f03edba98473f0c615e94d471f564a1ce0e1ad1e46575aa73
                                                                                                    • Instruction ID: 8f2fa2febc4f26b1538d43b78dffab47bf2f702b85a8b130a79407a5d35c8c29
                                                                                                    • Opcode Fuzzy Hash: 35b678d50e37562f03edba98473f0c615e94d471f564a1ce0e1ad1e46575aa73
                                                                                                    • Instruction Fuzzy Hash: 4BF062796103186FEB115FA4EC89E7B3BACFF4A795F000429FA45C7290DB609C45CB61
                                                                                                    Function 003FAAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 003FAADA
                                                                                                    • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 003FAAE4
                                                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 003FAAF3
                                                                                                    • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 003FAAFA
                                                                                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 003FAB10
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                                    • String ID:
                                                                                                    • API String ID: 44706859-0
                                                                                                    • Opcode ID: 73117e482e96e829e9295766ea52cf87d816b77c4737fc11cca0911f623c7606
                                                                                                    • Instruction ID: 7cf5bd65aa5b309d22ba934027c83c5c346d3a5b01f1b83d466b2238af84665f
                                                                                                    • Opcode Fuzzy Hash: 73117e482e96e829e9295766ea52cf87d816b77c4737fc11cca0911f623c7606
                                                                                                    • Instruction Fuzzy Hash: 33F062757002086FEB120FA4EC88E7B3B6DFF4A755F000039FA46C7190CA609C01CB61
                                                                                                    Function 003FEC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetDlgItem.USER32(?,000003E9), ref: 003FEC94
                                                                                                    • GetWindowTextW.USER32(00000000,?,00000100), ref: 003FECAB
                                                                                                    • MessageBeep.USER32(00000000), ref: 003FECC3
                                                                                                    • KillTimer.USER32(?,0000040A), ref: 003FECDF
                                                                                                    • EndDialog.USER32(?,00000001), ref: 003FECF9
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 3741023627-0
                                                                                                    • Opcode ID: d089839a1e6904727a25ab44bb15df4d5a032124c11a35a39337976a25718195
                                                                                                    • Instruction ID: e81705f408059633f3e2b2a5bf0bed64fdfcf4854dc8a30ac8b85728d7e6b384
                                                                                                    • Opcode Fuzzy Hash: d089839a1e6904727a25ab44bb15df4d5a032124c11a35a39337976a25718195
                                                                                                    • Instruction Fuzzy Hash: 2D018134900758ABEB269F10DE5EBA677B8FB01B05F01056DF692A14E0DBF4AA44CB54
                                                                                                    Function 003DB0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • EndPath.GDI32(?), ref: 003DB0BA
                                                                                                    • StrokeAndFillPath.GDI32(?,?,0043E680,00000000,?,?,?), ref: 003DB0D6
                                                                                                    • SelectObject.GDI32(?,00000000), ref: 003DB0E9
                                                                                                    • DeleteObject.GDI32 ref: 003DB0FC
                                                                                                    • StrokePath.GDI32(?), ref: 003DB117
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                    • String ID:
                                                                                                    • API String ID: 2625713937-0
                                                                                                    • Opcode ID: 8743d9a8efe486ab1890cf0116e7d88ebf069a96418f1ea3eb33478135144ecb
                                                                                                    • Instruction ID: 73ff40c80474ca02d5c93896dc8dd3ecd0ff67deb321c6d5acfc22927eb6e9ba
                                                                                                    • Opcode Fuzzy Hash: 8743d9a8efe486ab1890cf0116e7d88ebf069a96418f1ea3eb33478135144ecb
                                                                                                    • Instruction Fuzzy Hash: 56F03C35400244EFDB229F65FC0D75C3F68AB017A6F19872AF4A5555F0D7318956CF18
                                                                                                    Function 0040F23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CoInitialize.OLE32(00000000), ref: 0040F2DA
                                                                                                    • CoCreateInstance.OLE32(0044DA7C,00000000,00000001,0044D8EC,?), ref: 0040F2F2
                                                                                                    • CoUninitialize.OLE32 ref: 0040F555
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CreateInitializeInstanceUninitialize
                                                                                                    • String ID: .lnk
                                                                                                    • API String ID: 948891078-24824748
                                                                                                    • Opcode ID: d93b302ff5e2a9a59a40f893c38c3e2f94ab77442a056ab6114973eb9acf7f04
                                                                                                    • Instruction ID: fc4d714df8c78b6b3bd9de9566343040526f22bef3891d39d131b8632433be1f
                                                                                                    • Opcode Fuzzy Hash: d93b302ff5e2a9a59a40f893c38c3e2f94ab77442a056ab6114973eb9acf7f04
                                                                                                    • Instruction Fuzzy Hash: C8A12C72114201AFD301EF64C891EABB7E8EF98714F00496EF555DB292EB70EE49CB52
                                                                                                    Function 0040E7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003C53B1,?,?,003C61FF,?,00000000,00000001,00000000), ref: 003C662F
                                                                                                    • CoInitialize.OLE32(00000000), ref: 0040E85D
                                                                                                    • CoCreateInstance.OLE32(0044DA7C,00000000,00000001,0044D8EC,?), ref: 0040E876
                                                                                                    • CoUninitialize.OLE32 ref: 0040E893
                                                                                                      • Part of subcall function 003C936C: __swprintf.LIBCMT ref: 003C93AB
                                                                                                      • Part of subcall function 003C936C: __itow.LIBCMT ref: 003C93DF
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                                                                    • String ID: .lnk
                                                                                                    • API String ID: 2126378814-24824748
                                                                                                    • Opcode ID: 838d86900f1892358a275aa97985ccbc2acf65ea22bf49131e22943e384214ff
                                                                                                    • Instruction ID: 7dbc3ce068af945caf40a3295eae6bac1efab85486bad85184a0db13eae36066
                                                                                                    • Opcode Fuzzy Hash: 838d86900f1892358a275aa97985ccbc2acf65ea22bf49131e22943e384214ff
                                                                                                    • Instruction Fuzzy Hash: 7EA166756043019FCB11EF15C484E2ABBE5BF89310F14895EF99AAB3A2CB35EC45CB85
                                                                                                    Function 003E325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • __startOneArgErrorHandling.LIBCMT ref: 003E32ED
                                                                                                      • Part of subcall function 003EE0D0: __87except.LIBCMT ref: 003EE10B
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorHandling__87except__start
                                                                                                    • String ID: pow
                                                                                                    • API String ID: 2905807303-2276729525
                                                                                                    • Opcode ID: f45379242cc233ccf810e14c4c05dc78c57e1958fa47efb4a15e8a38ccad1a47
                                                                                                    • Instruction ID: 5641badef677f1e157e0f06d4abb4f2a7ab47170d37a4e3e3ff726ae62b22667
                                                                                                    • Opcode Fuzzy Hash: f45379242cc233ccf810e14c4c05dc78c57e1958fa47efb4a15e8a38ccad1a47
                                                                                                    • Instruction Fuzzy Hash: BD519C71A0C2E292CB177B16C90577E2B989B41710F218F29F0D5872E9DF34CEC89B46
                                                                                                    Function 00404606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,0045DC50,?,0000000F,0000000C,00000016,0045DC50,?), ref: 00404645
                                                                                                      • Part of subcall function 003C936C: __swprintf.LIBCMT ref: 003C93AB
                                                                                                      • Part of subcall function 003C936C: __itow.LIBCMT ref: 003C93DF
                                                                                                    • CharUpperBuffW.USER32(?,?,00000000,?), ref: 004046C5
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: BuffCharUpper$__itow__swprintf
                                                                                                    • String ID: REMOVE$THIS
                                                                                                    • API String ID: 3797816924-776492005
                                                                                                    • Opcode ID: 422f75b2d2f46021fb1edd5ba0a5b1fe62dc9eb64058dbec9f71cfbe863a930b
                                                                                                    • Instruction ID: de0d3131fe44d7e2754762ae56fce15656ec4e7d9e1130a45ad0f29133e32179
                                                                                                    • Opcode Fuzzy Hash: 422f75b2d2f46021fb1edd5ba0a5b1fe62dc9eb64058dbec9f71cfbe863a930b
                                                                                                    • Instruction Fuzzy Hash: DB41A474A002199FCF01EF54C885AAEB7B4FF85304F14846AEA16BB3A2DB38DD41CB54
                                                                                                    Function 003FC189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 0040430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,003FBC08,?,?,00000034,00000800,?,00000034), ref: 00404335
                                                                                                    • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 003FC1D3
                                                                                                      • Part of subcall function 004042D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,003FBC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00404300
                                                                                                      • Part of subcall function 0040422F: GetWindowThreadProcessId.USER32(?,?), ref: 0040425A
                                                                                                      • Part of subcall function 0040422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,003FBBCC,00000034,?,?,00001004,00000000,00000000), ref: 0040426A
                                                                                                      • Part of subcall function 0040422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,003FBBCC,00000034,?,?,00001004,00000000,00000000), ref: 00404280
                                                                                                    • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003FC240
                                                                                                    • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003FC28D
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                                                    • String ID: @
                                                                                                    • API String ID: 4150878124-2766056989
                                                                                                    • Opcode ID: 52f1293063e2141f81643939d45924fb39756693fbdfd7f47535c062e3db6364
                                                                                                    • Instruction ID: 4ed10f4ea95ed71a979844abb99e54860478784864c347803d99ded2a00e7ae3
                                                                                                    • Opcode Fuzzy Hash: 52f1293063e2141f81643939d45924fb39756693fbdfd7f47535c062e3db6364
                                                                                                    • Instruction Fuzzy Hash: 12414BB6A0021CBFDB11DFA4CD81AEEB7B8EF49304F0044A9FA45B7181DA756E45CB61
                                                                                                    Function 0042A63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0045DC00,00000000,?,?,?,?), ref: 0042A6D8
                                                                                                    • GetWindowLongW.USER32 ref: 0042A6F5
                                                                                                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0042A705
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$Long
                                                                                                    • String ID: SysTreeView32
                                                                                                    • API String ID: 847901565-1698111956
                                                                                                    • Opcode ID: c8dd092625b56e205ab670ef279649c04b21e18f1e9658d0f7fcedde48088295
                                                                                                    • Instruction ID: 3373b76d32b3b570b1c503a9d86df89b721b415589323149a1f522383f0cc3a8
                                                                                                    • Opcode Fuzzy Hash: c8dd092625b56e205ab670ef279649c04b21e18f1e9658d0f7fcedde48088295
                                                                                                    • Instruction Fuzzy Hash: AD31B231600215AFDB118F34DC45BEB77A9EF49324F254726F9B5932E0D734E8618B58
                                                                                                    Function 00415180 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 00415190
                                                                                                    • InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 004151C6
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CrackInternet_memset
                                                                                                    • String ID: |$DA
                                                                                                    • API String ID: 1413715105-2638527111
                                                                                                    • Opcode ID: 1084d28ada4d015780564e194a07db2c8413d6bcf46839d45aa10ce661d5167c
                                                                                                    • Instruction ID: d479b5e5e0198b017a02837e2c75a6c1751aad3a3196a1bd04afb3630b00f47a
                                                                                                    • Opcode Fuzzy Hash: 1084d28ada4d015780564e194a07db2c8413d6bcf46839d45aa10ce661d5167c
                                                                                                    • Instruction Fuzzy Hash: F8311871C10119EBCF12EFA4CC85EEE7FB9FF54700F10005AE919AA166DB35A946CBA0
                                                                                                    Function 0042A0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0042A15E
                                                                                                    • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 0042A172
                                                                                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 0042A196
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$Window
                                                                                                    • String ID: SysMonthCal32
                                                                                                    • API String ID: 2326795674-1439706946
                                                                                                    • Opcode ID: 5f3bbac5e9f9435612e126da37de51367de371daf71bfe0e37334ca93b07137a
                                                                                                    • Instruction ID: f58443d7b260b4e4c707dfa2ffe7acea2a2769fe8526afa15157625377d6e3bc
                                                                                                    • Opcode Fuzzy Hash: 5f3bbac5e9f9435612e126da37de51367de371daf71bfe0e37334ca93b07137a
                                                                                                    • Instruction Fuzzy Hash: EF21BF32600228BBDF158F94DC42FEA3B79EF48724F110215FE556B1D0D6B9AC61CBA4
                                                                                                    Function 0042A88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0042A941
                                                                                                    • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0042A94F
                                                                                                    • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0042A956
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$DestroyWindow
                                                                                                    • String ID: msctls_updown32
                                                                                                    • API String ID: 4014797782-2298589950
                                                                                                    • Opcode ID: 3470916cb806fa680765c659b8a1da156f1e4db4f769c9ff6eaea8f1bac96894
                                                                                                    • Instruction ID: c3092fee2b5c93cab5b461e4728356f9aa0c4a77527aa33a9bb4ee08ac863b2f
                                                                                                    • Opcode Fuzzy Hash: 3470916cb806fa680765c659b8a1da156f1e4db4f769c9ff6eaea8f1bac96894
                                                                                                    • Instruction Fuzzy Hash: 7021C1B5600219AFDB01DF19DC81D7B37ACEF4A3A4B45045AFA049B3A1DB34EC52CB69
                                                                                                    Function 004299A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00429A30
                                                                                                    • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00429A40
                                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00429A65
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$MoveWindow
                                                                                                    • String ID: Listbox
                                                                                                    • API String ID: 3315199576-2633736733
                                                                                                    • Opcode ID: a7951243a1174ad10c7446b709aca66a96c8f4ee835dfdbdafdbd219bb6c6163
                                                                                                    • Instruction ID: 25005773262c5f3890e83ddbcda1e4f8f22bc7f8735acfa51e82c893943b64a2
                                                                                                    • Opcode Fuzzy Hash: a7951243a1174ad10c7446b709aca66a96c8f4ee835dfdbdafdbd219bb6c6163
                                                                                                    • Instruction Fuzzy Hash: F321D372700128BFDB118F54EC85FBB3BAAEF89760F41812AF9449B290C6759C52C7A4
                                                                                                    Function 0042A409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0042A46D
                                                                                                    • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 0042A482
                                                                                                    • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 0042A48F
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend
                                                                                                    • String ID: msctls_trackbar32
                                                                                                    • API String ID: 3850602802-1010561917
                                                                                                    • Opcode ID: 7b18515d92632df555162901d259a810ef893531f94a12bc376e9bf9715d0a90
                                                                                                    • Instruction ID: 2430f02ed2b239124ecc7cb5a33a065f01908305056bb9fac19539fb5dbd1f47
                                                                                                    • Opcode Fuzzy Hash: 7b18515d92632df555162901d259a810ef893531f94a12bc376e9bf9715d0a90
                                                                                                    • Instruction Fuzzy Hash: 5911E771200218BFEF209F65DC49FAB3769EF89754F014129FE45A6191D2B5E821C728
                                                                                                    Function 003E2287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,003E2350,?), ref: 003E22A1
                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 003E22A8
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                    • String ID: RoInitialize$combase.dll
                                                                                                    • API String ID: 2574300362-340411864
                                                                                                    • Opcode ID: 53b391472f3754038d36b8f7dc2add7364ccdfb2d0da27b79625b9a57340ccee
                                                                                                    • Instruction ID: c1366c368d20a648ec727dc8e9ddf56a14a96ebf069a6908354e648b8c20f4c6
                                                                                                    • Opcode Fuzzy Hash: 53b391472f3754038d36b8f7dc2add7364ccdfb2d0da27b79625b9a57340ccee
                                                                                                    • Instruction Fuzzy Hash: F9E01A74AA0340ABEB905F75EC4EB1A3668BB41716F114C78F242E50E0CBBA4088CF0C
                                                                                                    Function 003E235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,003E2276), ref: 003E2376
                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 003E237D
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                    • String ID: RoUninitialize$combase.dll
                                                                                                    • API String ID: 2574300362-2819208100
                                                                                                    • Opcode ID: 0c05f6dd3b15dfad1f4a4e3f4bca86828dd22ce996d3d34f335e289ff81997a1
                                                                                                    • Instruction ID: 723ae0538b20bcf29bfa0e43271658c9bbc6948e2b854e59a7978f0df009e34f
                                                                                                    • Opcode Fuzzy Hash: 0c05f6dd3b15dfad1f4a4e3f4bca86828dd22ce996d3d34f335e289ff81997a1
                                                                                                    • Instruction Fuzzy Hash: B7E0B674A54740ABEB625F61ED0DB0A3A6AB700B16F110C78F109E21B4CBBA5458CB1C
                                                                                                    Function 0043AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: LocalTime__swprintf
                                                                                                    • String ID: %.3d$WIN_XPe
                                                                                                    • API String ID: 2070861257-2409531811
                                                                                                    • Opcode ID: a6b5f24b98c0017f5018965edb0145a6161c514272b90da48fb527214c64596c
                                                                                                    • Instruction ID: 20d0ba27393fffab5ee484f0b6978b8082ea12e77b2412a4bfe44fe48bbf4e07
                                                                                                    • Opcode Fuzzy Hash: a6b5f24b98c0017f5018965edb0145a6161c514272b90da48fb527214c64596c
                                                                                                    • Instruction Fuzzy Hash: 83E0ECB28446189BCA1197509D059F9737CA708741F1020D3F946A2140D7399BA6AA1B
                                                                                                    Function 00422205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,004221FB,?,004223EF), ref: 00422213
                                                                                                    • GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00422225
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                    • String ID: GetProcessId$kernel32.dll
                                                                                                    • API String ID: 2574300362-399901964
                                                                                                    • Opcode ID: 11ffb3fb8192accea23f64132f73f301054a7036b150585895c22cd8fd01f9f3
                                                                                                    • Instruction ID: 6d7fe37dd2b8d6df368b878b005cde4188800a9b2e35207ea529e84a261f9f12
                                                                                                    • Opcode Fuzzy Hash: 11ffb3fb8192accea23f64132f73f301054a7036b150585895c22cd8fd01f9f3
                                                                                                    • Instruction Fuzzy Hash: F7D0A738A00B22EFC7214F30FA0874276D4EB05304B10887BEC45E2250EBF9D880C768
                                                                                                    Function 003C42F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,00000000,003C42EC,?,003C42AA,?), ref: 003C4304
                                                                                                    • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 003C4316
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                    • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                                                    • API String ID: 2574300362-1355242751
                                                                                                    • Opcode ID: 7dec1ea4d2ae899f286f9ffcc89d3f5804c935ffed1d18f6810223bac177c7bc
                                                                                                    • Instruction ID: c6179abad3670152b57248943b312dd5d979d6cd1a60a4757797d57e60e58e04
                                                                                                    • Opcode Fuzzy Hash: 7dec1ea4d2ae899f286f9ffcc89d3f5804c935ffed1d18f6810223bac177c7bc
                                                                                                    • Instruction Fuzzy Hash: 1ED0A778900B129FC7214F20EC0CB4176D4AB05301B11843EE945D2164D7B4CC80C714
                                                                                                    Function 003C434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,003C41BB,003C4341,?,003C422F,?,003C41BB,?,?,?,?,003C39FE,?,00000001), ref: 003C4359
                                                                                                    • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 003C436B
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                    • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                                                    • API String ID: 2574300362-3689287502
                                                                                                    • Opcode ID: 8e1ae5bf30c153d883dc3a758f1a10942eff3bd232bfe6de46e26e85de61ab91
                                                                                                    • Instruction ID: 97be393eb4ccb4504b9c3957418b84375052f50c426182c43202759acd6bc4b2
                                                                                                    • Opcode Fuzzy Hash: 8e1ae5bf30c153d883dc3a758f1a10942eff3bd232bfe6de46e26e85de61ab91
                                                                                                    • Instruction Fuzzy Hash: 3ED0A778900F129FC7214F30EA08B4276D4AB11715B11843EE885D2150D7B4DC80CB54
                                                                                                    Function 00400564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadLibraryA.KERNEL32(oleaut32.dll,00000000,0040052F,?,004006D7), ref: 00400572
                                                                                                    • GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00400584
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                    • String ID: UnRegisterTypeLibForUser$oleaut32.dll
                                                                                                    • API String ID: 2574300362-1587604923
                                                                                                    • Opcode ID: 0d5d23a1cf815f9e09e24cf220eec00d7d5c7d2aedb57bcfb785585ddc1520d5
                                                                                                    • Instruction ID: 69ff94fc55b77b73376bb6e2fe5093453bb34bc7f82826623e6be3e22abec63c
                                                                                                    • Opcode Fuzzy Hash: 0d5d23a1cf815f9e09e24cf220eec00d7d5c7d2aedb57bcfb785585ddc1520d5
                                                                                                    • Instruction Fuzzy Hash: ABD09E74904712AAD7209F75AC08B4277F8AB05711F60897BEC55A2294D6B8D4848B68
                                                                                                    Function 00400539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadLibraryA.KERNEL32(oleaut32.dll,?,0040051D,?,004005FE), ref: 00400547
                                                                                                    • GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00400559
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                    • String ID: RegisterTypeLibForUser$oleaut32.dll
                                                                                                    • API String ID: 2574300362-1071820185
                                                                                                    • Opcode ID: 2cb511882c1423735c47a4e5d1c05d4f83fd6b9ca48bc45f4e08b9a5bf113705
                                                                                                    • Instruction ID: 84bbe74d171423364e69b6369dd2acc83ef08c123da23683e0eebf0b04002d58
                                                                                                    • Opcode Fuzzy Hash: 2cb511882c1423735c47a4e5d1c05d4f83fd6b9ca48bc45f4e08b9a5bf113705
                                                                                                    • Instruction Fuzzy Hash: 8ED0C774944B22AFD720DF75EC0874276E4AB15755F20C47FE89AE3294D6B8C884CA58
                                                                                                    Function 0041ECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,0041ECBE,?,0041EBBB), ref: 0041ECD6
                                                                                                    • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0041ECE8
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                    • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                                    • API String ID: 2574300362-1816364905
                                                                                                    • Opcode ID: 0687fe2fe753a13b3a94590f9cb8248de2a0d9c026b8ad211a2e2d16873ff6bb
                                                                                                    • Instruction ID: ee1724cca25dee924d39888684aa0bb4a598070ea67573179901feb29e568ac1
                                                                                                    • Opcode Fuzzy Hash: 0687fe2fe753a13b3a94590f9cb8248de2a0d9c026b8ad211a2e2d16873ff6bb
                                                                                                    • Instruction Fuzzy Hash: B1D0A738900B239FCB205F61ED4878376E4AB42300B10C43BFC4AD2250EBB8C8C0DB58
                                                                                                    Function 0041BADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,00000000,0041BAD3,00000001,0041B6EE,?,0045DC00), ref: 0041BAEB
                                                                                                    • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 0041BAFD
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                    • String ID: GetModuleHandleExW$kernel32.dll
                                                                                                    • API String ID: 2574300362-199464113
                                                                                                    • Opcode ID: e798e6b73594f3ef192a9129faea9eaafa2b41a5ff565d73e4f7037134b99b34
                                                                                                    • Instruction ID: bf005a41ecb2950153101c5f68c56de72b10a7bc7a61389a842124fd630c5611
                                                                                                    • Opcode Fuzzy Hash: e798e6b73594f3ef192a9129faea9eaafa2b41a5ff565d73e4f7037134b99b34
                                                                                                    • Instruction Fuzzy Hash: 21D05E34D04B129EC7309F20A848B9276E4AB01300B20842BB84792A54D7B8D880C658
                                                                                                    Function 00423BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadLibraryA.KERNEL32(advapi32.dll,?,00423BD1,?,00423E06), ref: 00423BE9
                                                                                                    • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00423BFB
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AddressLibraryLoadProc
                                                                                                    • String ID: RegDeleteKeyExW$advapi32.dll
                                                                                                    • API String ID: 2574300362-4033151799
                                                                                                    • Opcode ID: 98d24f2cf6e99d123e9d01ba7d23abfbd34f07f1929b5cfdb065445019150996
                                                                                                    • Instruction ID: 0482de7554b4abee2719598cca50438b3ba6046ef0620ecc26076600525ccd59
                                                                                                    • Opcode Fuzzy Hash: 98d24f2cf6e99d123e9d01ba7d23abfbd34f07f1929b5cfdb065445019150996
                                                                                                    • Instruction Fuzzy Hash: C6D0A775B007629FC7205FA1F808753BAF4AB02315B20843FE849E2350D7BCC480CE18
                                                                                                    Function 003F9B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON
                                                                                                    Download Yara Rule
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID:
                                                                                                    • String ID:
                                                                                                    • API String ID:
                                                                                                    • Opcode ID: b6fb6548ba7f8cf464b192af3b5ebdae272b396d0c188220ce9454648530a374
                                                                                                    • Instruction ID: ac69c39b0524b25a56986a697cb8df3a1e130086886c2ff6fa654d8d2a0100d3
                                                                                                    • Opcode Fuzzy Hash: b6fb6548ba7f8cf464b192af3b5ebdae272b396d0c188220ce9454648530a374
                                                                                                    • Instruction Fuzzy Hash: 28C14A75A0021AEFCB15DF94C884BBEB7B9FF48704F11459AEA05AB251D730EE41DB90
                                                                                                    Function 0041AA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CoInitialize.OLE32(00000000), ref: 0041AAB4
                                                                                                    • CoUninitialize.OLE32 ref: 0041AABF
                                                                                                      • Part of subcall function 00400213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0040027B
                                                                                                    • VariantInit.OLEAUT32(?), ref: 0041AACA
                                                                                                    • VariantClear.OLEAUT32(?), ref: 0041AD9D
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                                                                    • String ID:
                                                                                                    • API String ID: 780911581-0
                                                                                                    • Opcode ID: 3b929489f6ee7f82af80d44ed439d3f8fe120cb28a1ff6cd7cf7fc37f55fc8f6
                                                                                                    • Instruction ID: 73933df4fb62fe2c1d23a29ce7fb863080d7aff4a655cac753b3ddb042f585fe
                                                                                                    • Opcode Fuzzy Hash: 3b929489f6ee7f82af80d44ed439d3f8fe120cb28a1ff6cd7cf7fc37f55fc8f6
                                                                                                    • Instruction Fuzzy Hash: EBA14875204B019FCB11EF14C885B5AB7E5BF88710F04445EFA9A9B3A2CB34ED45CB8A
                                                                                                    Function 003F91CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Variant$AllocClearCopyInitString
                                                                                                    • String ID:
                                                                                                    • API String ID: 2808897238-0
                                                                                                    • Opcode ID: 3ad18e1b035560a79826c43a57f01a179a2cdec1ec5f49a237db29f4eb601c56
                                                                                                    • Instruction ID: fd88d9095a2a66f6e47c0f80808771f2f8770d3be9e090bf4501834ef3e6ea84
                                                                                                    • Opcode Fuzzy Hash: 3ad18e1b035560a79826c43a57f01a179a2cdec1ec5f49a237db29f4eb601c56
                                                                                                    • Instruction Fuzzy Hash: EF51B739A0430A9BDB26AF66D491B3EB3EDEF45314F24882FE646CB6D1DB7498408705
                                                                                                    Function 0042C4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetWindowRect.USER32(01067D30,?), ref: 0042C544
                                                                                                    • ScreenToClient.USER32(?,00000002), ref: 0042C574
                                                                                                    • MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 0042C5DA
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$ClientMoveRectScreen
                                                                                                    • String ID:
                                                                                                    • API String ID: 3880355969-0
                                                                                                    • Opcode ID: aa636c99db794b9ef6f38e03d08f09cd08c4b5d30e4d4be4b9e3fae3a546b2c5
                                                                                                    • Instruction ID: d46359596147539370966a88d6f6e9dd298b7deba4d442ec1e0fd7ad759a88bb
                                                                                                    • Opcode Fuzzy Hash: aa636c99db794b9ef6f38e03d08f09cd08c4b5d30e4d4be4b9e3fae3a546b2c5
                                                                                                    • Instruction Fuzzy Hash: B5516E75A00114EFCF20DF68D8C0AAE77B6EF55320F50866AF9559B290D734ED81CB94
                                                                                                    Function 003FC410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 003FC462
                                                                                                    • __itow.LIBCMT ref: 003FC49C
                                                                                                      • Part of subcall function 003FC6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 003FC753
                                                                                                    • SendMessageW.USER32(?,0000110A,00000001,?), ref: 003FC505
                                                                                                    • __itow.LIBCMT ref: 003FC55A
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend$__itow
                                                                                                    • String ID:
                                                                                                    • API String ID: 3379773720-0
                                                                                                    • Opcode ID: 86fe6cd8898870413af6482b402febe572694fcad37a1c40a0043de36d478805
                                                                                                    • Instruction ID: 7b4b73c167fc200b281a48501c64555e9228250719056cf8c280d988dd86a1a1
                                                                                                    • Opcode Fuzzy Hash: 86fe6cd8898870413af6482b402febe572694fcad37a1c40a0043de36d478805
                                                                                                    • Instruction Fuzzy Hash: CA41A171A4020CABDF13DF55C955FFE7BB9AF49700F001019FA09AB281DB74AE458BA1
                                                                                                    Function 0040390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00403966
                                                                                                    • SetKeyboardState.USER32(00000080,?,00000001), ref: 00403982
                                                                                                    • PostMessageW.USER32(00000000,00000102,?,00000001), ref: 004039EF
                                                                                                    • SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00403A4D
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: KeyboardState$InputMessagePostSend
                                                                                                    • String ID:
                                                                                                    • API String ID: 432972143-0
                                                                                                    • Opcode ID: cf8fc8cb8a3d4f11a5a1df5b08e95e1b1699d1b156ca0219ed3956bca20da128
                                                                                                    • Instruction ID: 5bedc0874089159c352fd007ca6af5dafea2cb15bfae8a4be5bece0959028377
                                                                                                    • Opcode Fuzzy Hash: cf8fc8cb8a3d4f11a5a1df5b08e95e1b1699d1b156ca0219ed3956bca20da128
                                                                                                    • Instruction Fuzzy Hash: ED41E5B0A442086AEF208F6588097FABFB99B45312F04017BE4C1762C1C7BC9E859B69
                                                                                                    Function 0040E698 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0040E742
                                                                                                    • GetLastError.KERNEL32(?,00000000), ref: 0040E768
                                                                                                    • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0040E78D
                                                                                                    • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0040E7B9
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                    • String ID:
                                                                                                    • API String ID: 3321077145-0
                                                                                                    • Opcode ID: a9588f657706bc04fc5845d804e7a6327bcd0a4573e394992893cf5bfdd89e5e
                                                                                                    • Instruction ID: a95dd88597839e6834d10720e18b136490f73eb37c6f617ff71d93eb821c56b4
                                                                                                    • Opcode Fuzzy Hash: a9588f657706bc04fc5845d804e7a6327bcd0a4573e394992893cf5bfdd89e5e
                                                                                                    • Instruction Fuzzy Hash: DF412A39600610DFCF12EF15C445A4DBBE5BF99710B0984AAE946AF3A2CB74FD40CB95
                                                                                                    Function 0042B544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0042B5D1
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: InvalidateRect
                                                                                                    • String ID:
                                                                                                    • API String ID: 634782764-0
                                                                                                    • Opcode ID: 97180f9aa662486bb239fa857f0ee8dd985dd440d0cc0678be806002f1ae95c3
                                                                                                    • Instruction ID: fe5718667961bda368a276f23b23e063f1ddd9eb5f06124b49d774e7275e678d
                                                                                                    • Opcode Fuzzy Hash: 97180f9aa662486bb239fa857f0ee8dd985dd440d0cc0678be806002f1ae95c3
                                                                                                    • Instruction Fuzzy Hash: 1431B234700124BBEB208B18EC85FA93764EB06354F944517FA51DA2E1D738A9819BDE
                                                                                                    Function 0042D7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • ClientToScreen.USER32(?,?), ref: 0042D807
                                                                                                    • GetWindowRect.USER32(?,?), ref: 0042D87D
                                                                                                    • PtInRect.USER32(?,?,0042ED5A), ref: 0042D88D
                                                                                                    • MessageBeep.USER32(00000000), ref: 0042D8FE
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 1352109105-0
                                                                                                    • Opcode ID: 4dc4d7701bb9e8a4b249ec6388c400e63122d6c6a94245caf4080344d95d4524
                                                                                                    • Instruction ID: 44c57a4f6f2af67b5dfddad2da7c0b2081c1fda67152c3239af4f254c472497e
                                                                                                    • Opcode Fuzzy Hash: 4dc4d7701bb9e8a4b249ec6388c400e63122d6c6a94245caf4080344d95d4524
                                                                                                    • Instruction Fuzzy Hash: 7B41AC74F00228DFCB15EF59E880B697BB5BF45310F5881AAE4249B260D334E846CB48
                                                                                                    Function 00403A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00403AB8
                                                                                                    • SetKeyboardState.USER32(00000080,?,00008000), ref: 00403AD4
                                                                                                    • PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00403B34
                                                                                                    • SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00403B92
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: KeyboardState$InputMessagePostSend
                                                                                                    • String ID:
                                                                                                    • API String ID: 432972143-0
                                                                                                    • Opcode ID: 85fb80fe5fd9991d0e3984437ed5573f50010840c154822d010b47fdfebd0fea
                                                                                                    • Instruction ID: c15bce90c37e0c8590791548c1d6efc95d064346c8464ce291bbde5ddb51503d
                                                                                                    • Opcode Fuzzy Hash: 85fb80fe5fd9991d0e3984437ed5573f50010840c154822d010b47fdfebd0fea
                                                                                                    • Instruction Fuzzy Hash: 3631F630A40258AEEB209F6488197BE7FBD9B5531AF04017BE481B22D3C77CAE45D769
                                                                                                    Function 003F4004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 003F4038
                                                                                                    • __isleadbyte_l.LIBCMT ref: 003F4066
                                                                                                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 003F4094
                                                                                                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 003F40CA
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                    • String ID:
                                                                                                    • API String ID: 3058430110-0
                                                                                                    • Opcode ID: 4fbacd255dc1a2039089f8cb6d595035072d3a80fdca5707f5ec45ecd89b5336
                                                                                                    • Instruction ID: 065ddb6499628c13f9997143464630625a9cb36a2a6db119e6fb00227695c3ed
                                                                                                    • Opcode Fuzzy Hash: 4fbacd255dc1a2039089f8cb6d595035072d3a80fdca5707f5ec45ecd89b5336
                                                                                                    • Instruction Fuzzy Hash: 3631B23160025BAFDB229F75C844B7BBBB5BF41310F164528EB658B191EB31D891D790
                                                                                                    Function 00427CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetForegroundWindow.USER32 ref: 00427CB9
                                                                                                      • Part of subcall function 00405F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 00405F6F
                                                                                                      • Part of subcall function 00405F55: GetCurrentThreadId.KERNEL32 ref: 00405F76
                                                                                                      • Part of subcall function 00405F55: AttachThreadInput.USER32(00000000,?,0040781F), ref: 00405F7D
                                                                                                    • GetCaretPos.USER32(?), ref: 00427CCA
                                                                                                    • ClientToScreen.USER32(00000000,?), ref: 00427D03
                                                                                                    • GetForegroundWindow.USER32 ref: 00427D09
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                    • String ID:
                                                                                                    • API String ID: 2759813231-0
                                                                                                    • Opcode ID: 1b41f60a4424f2d8425ad5be21d74e49371e6d942a6c74dccd4e98053002dd79
                                                                                                    • Instruction ID: 1408f5f273c340d855c423330eab3d1f687081547d405486033af5baa5f5d4f4
                                                                                                    • Opcode Fuzzy Hash: 1b41f60a4424f2d8425ad5be21d74e49371e6d942a6c74dccd4e98053002dd79
                                                                                                    • Instruction Fuzzy Hash: D7312D76D00108AFDB01EFA9D8859EFBBF9EF58314B10846BE815E7211DA359E05CFA4
                                                                                                    Function 0042F1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DB34E: GetWindowLongW.USER32(?,000000EB), ref: 003DB35F
                                                                                                    • GetCursorPos.USER32(?), ref: 0042F211
                                                                                                    • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0043E4C0,?,?,?,?,?), ref: 0042F226
                                                                                                    • GetCursorPos.USER32(?), ref: 0042F270
                                                                                                    • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0043E4C0,?,?,?), ref: 0042F2A6
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 2864067406-0
                                                                                                    • Opcode ID: 49cbb1a009e4f1bb83eb4c37195138a0fe26d323dea819650debec579b996566
                                                                                                    • Instruction ID: 57f826fd0cdc53c7d0cc486bbe4790cc8d2859a306139a2b23f4f314151b3cf4
                                                                                                    • Opcode Fuzzy Hash: 49cbb1a009e4f1bb83eb4c37195138a0fe26d323dea819650debec579b996566
                                                                                                    • Instruction Fuzzy Hash: 4321D239600024EFCB158F94E848EEF7BB9EF0A310F9444BAF9055B2A1D7359D51DB68
                                                                                                    Function 0041431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00414358
                                                                                                      • Part of subcall function 004143E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00414401
                                                                                                      • Part of subcall function 004143E2: InternetCloseHandle.WININET(00000000), ref: 0041449E
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Internet$CloseConnectHandleOpen
                                                                                                    • String ID:
                                                                                                    • API String ID: 1463438336-0
                                                                                                    • Opcode ID: ef83a45fd9a967a3ecbbb1f2f2a2578cbe214d4dcd38c530690e86aec4160972
                                                                                                    • Instruction ID: 804721bdaa2bd4ec54cf472015ca9d1e360e68751d813f45e49a12c5b881d046
                                                                                                    • Opcode Fuzzy Hash: ef83a45fd9a967a3ecbbb1f2f2a2578cbe214d4dcd38c530690e86aec4160972
                                                                                                    • Instruction Fuzzy Hash: 0421D735700609BFDB119F60DC00FFBB7A9FF85714F00401FBA2596650D77594619798
                                                                                                    Function 00418A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00418AE0
                                                                                                    • __WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00418AF2
                                                                                                    • accept.WSOCK32(00000000,00000000,00000000), ref: 00418AFF
                                                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00418B16
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ErrorLastacceptselect
                                                                                                    • String ID:
                                                                                                    • API String ID: 385091864-0
                                                                                                    • Opcode ID: 78ee37365d94d81e13c17d4c5f10b7f006eced7156642aa6610ab27460701c8e
                                                                                                    • Instruction ID: af6b6f8bd8376ceda3417a2317169f5e4323ad2b593cb81871f4a28bb69499d6
                                                                                                    • Opcode Fuzzy Hash: 78ee37365d94d81e13c17d4c5f10b7f006eced7156642aa6610ab27460701c8e
                                                                                                    • Instruction Fuzzy Hash: 65219376A001249FC711DF69DC85ADEBBECEF4A310F00416AF849D7290DB749E818F94
                                                                                                    Function 00428A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetWindowLongW.USER32(?,000000EC), ref: 00428AA6
                                                                                                    • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00428AC0
                                                                                                    • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00428ACE
                                                                                                    • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00428ADC
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$Long$AttributesLayered
                                                                                                    • String ID:
                                                                                                    • API String ID: 2169480361-0
                                                                                                    • Opcode ID: 6ccd946d83aede014412b74110d18c6d66f466a7377cbdb5ae9354c28188e3cc
                                                                                                    • Instruction ID: 395a297bf7708e290a1cadfeb6b95ce639b691f17b36c85af1c8cc724f4a6e0e
                                                                                                    • Opcode Fuzzy Hash: 6ccd946d83aede014412b74110d18c6d66f466a7377cbdb5ae9354c28188e3cc
                                                                                                    • Instruction Fuzzy Hash: 66118E32706521AFDB05AB18DC05FBE7799AF86320F14412EF916CB2E1CF74AD018799
                                                                                                    Function 00400AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 00401E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00400ABB,?,?,?,0040187A,00000000,000000EF,00000119,?,?), ref: 00401E77
                                                                                                      • Part of subcall function 00401E68: lstrcpyW.KERNEL32(00000000,?,?,00400ABB,?,?,?,0040187A,00000000,000000EF,00000119,?,?,00000000), ref: 00401E9D
                                                                                                      • Part of subcall function 00401E68: lstrcmpiW.KERNEL32(00000000,?,00400ABB,?,?,?,0040187A,00000000,000000EF,00000119,?,?), ref: 00401ECE
                                                                                                    • lstrlenW.KERNEL32(?,00000002,?,?,?,?,0040187A,00000000,000000EF,00000119,?,?,00000000), ref: 00400AD4
                                                                                                    • lstrcpyW.KERNEL32(00000000,?,?,0040187A,00000000,000000EF,00000119,?,?,00000000), ref: 00400AFA
                                                                                                    • lstrcmpiW.KERNEL32(00000002,cdecl,?,0040187A,00000000,000000EF,00000119,?,?,00000000), ref: 00400B2E
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: lstrcmpilstrcpylstrlen
                                                                                                    • String ID: cdecl
                                                                                                    • API String ID: 4031866154-3896280584
                                                                                                    • Opcode ID: 36b11b78cca2719924e8a1a7d57def9064c7dc6f167b1d32456ca194cda7c41d
                                                                                                    • Instruction ID: f332ee811739799adef3c49a302fc8a397dedd75497be32b3c76bcc9514b6af3
                                                                                                    • Opcode Fuzzy Hash: 36b11b78cca2719924e8a1a7d57def9064c7dc6f167b1d32456ca194cda7c41d
                                                                                                    • Instruction Fuzzy Hash: 5711AF3A200305AFDB25AF64D845E7A77B8FF45354F80413BE806CB2A0EB75E850C7A8
                                                                                                    Function 003F2F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _free.LIBCMT ref: 003F2FB5
                                                                                                      • Part of subcall function 003E395C: __FF_MSGBANNER.LIBCMT ref: 003E3973
                                                                                                      • Part of subcall function 003E395C: __NMSG_WRITE.LIBCMT ref: 003E397A
                                                                                                      • Part of subcall function 003E395C: RtlAllocateHeap.NTDLL(01040000,00000000,00000001,00000001,00000000,?,?,003DF507,?,0000000E), ref: 003E399F
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: AllocateHeap_free
                                                                                                    • String ID:
                                                                                                    • API String ID: 614378929-0
                                                                                                    • Opcode ID: 5b1fd4b2265f61eef0ebab562557c3bfd0af896d369a69ad9b93fd64aa09d839
                                                                                                    • Instruction ID: cfa7f5a30d4d99c18e22b85c7990e2a89b759eddf411c0f6a7f343e0077c5c0d
                                                                                                    • Opcode Fuzzy Hash: 5b1fd4b2265f61eef0ebab562557c3bfd0af896d369a69ad9b93fd64aa09d839
                                                                                                    • Instruction Fuzzy Hash: 0811AB7154926BEBDB233F75AC0567A3B98AF04360F214625FA4ADE1E1DF30C9409A94
                                                                                                    Function 0040058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 004005AC
                                                                                                    • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 004005C7
                                                                                                    • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 004005DD
                                                                                                    • FreeLibrary.KERNEL32(?), ref: 00400632
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Type$FileFreeLibraryLoadModuleNameRegister
                                                                                                    • String ID:
                                                                                                    • API String ID: 3137044355-0
                                                                                                    • Opcode ID: 766a9369a37a8e5582142b42dd1fcc63eb864f76f154099e705fff880291c793
                                                                                                    • Instruction ID: 49b74f857e6f3d4246f058bcda3ebb50ae9c1b15dfbbc2fd1508595c4e2776a2
                                                                                                    • Opcode Fuzzy Hash: 766a9369a37a8e5582142b42dd1fcc63eb864f76f154099e705fff880291c793
                                                                                                    • Instruction Fuzzy Hash: 3B21AF71940208EFDB20CF91DC88BDABBB9EF40704F00887EE916A2190D779EA55DF59
                                                                                                    Function 00406713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00406733
                                                                                                    • _memset.LIBCMT ref: 00406754
                                                                                                    • DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 004067A6
                                                                                                    • CloseHandle.KERNEL32(00000000), ref: 004067AF
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CloseControlCreateDeviceFileHandle_memset
                                                                                                    • String ID:
                                                                                                    • API String ID: 1157408455-0
                                                                                                    • Opcode ID: 250c082f3ccaf589595f892ad4855880747ad337e19130070f7487a1d3108db3
                                                                                                    • Instruction ID: 565e96f374a1ee269feaf07f0cf16c25b2dbeaeb3aa39d1206e0df07ea9d2f90
                                                                                                    • Opcode Fuzzy Hash: 250c082f3ccaf589595f892ad4855880747ad337e19130070f7487a1d3108db3
                                                                                                    • Instruction Fuzzy Hash: 3B110A75D012287AE7205BA5AC4DFABBABCEF45B24F1041AAF905E71C0D3744E808B69
                                                                                                    Function 003FB1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003FAA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003FAA79
                                                                                                      • Part of subcall function 003FAA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003FAA83
                                                                                                      • Part of subcall function 003FAA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003FAA92
                                                                                                      • Part of subcall function 003FAA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003FAA99
                                                                                                      • Part of subcall function 003FAA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003FAAAF
                                                                                                    • GetLengthSid.ADVAPI32(?,00000000,003FADE4,?,?), ref: 003FB21B
                                                                                                    • GetProcessHeap.KERNEL32(00000008,00000000), ref: 003FB227
                                                                                                    • HeapAlloc.KERNEL32(00000000), ref: 003FB22E
                                                                                                    • CopySid.ADVAPI32(?,00000000,?), ref: 003FB247
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
                                                                                                    • String ID:
                                                                                                    • API String ID: 4217664535-0
                                                                                                    • Opcode ID: 6388bffc5f656fe7d5629842429a3bd30ce13ba02b4c2f26ce8f94e9d7ac20db
                                                                                                    • Instruction ID: cbf6e598546079bb8cab98fbf3a0fc261cca958ac8fb6b4525eeabd4546ce3c8
                                                                                                    • Opcode Fuzzy Hash: 6388bffc5f656fe7d5629842429a3bd30ce13ba02b4c2f26ce8f94e9d7ac20db
                                                                                                    • Instruction Fuzzy Hash: 7011A3B5A10209FFDB159F94DC95ABEB7B9EF85308F15842DEA42D7210D731AE44CB10
                                                                                                    Function 003FB478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 003FB498
                                                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 003FB4AA
                                                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 003FB4C0
                                                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 003FB4DB
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend
                                                                                                    • String ID:
                                                                                                    • API String ID: 3850602802-0
                                                                                                    • Opcode ID: f9329d92c07c6dcc49a22f8e68bf48036ade76a9cac330e21257ed30e995fc95
                                                                                                    • Instruction ID: da976ddd654452000eecd9d19eb103c96131b89df85ce2e1feccd4acd31ce096
                                                                                                    • Opcode Fuzzy Hash: f9329d92c07c6dcc49a22f8e68bf48036ade76a9cac330e21257ed30e995fc95
                                                                                                    • Instruction Fuzzy Hash: 461118BA900218FFDB11DFA9C985EADBBB8FB08710F204091E604B7295D771AE11DB94
                                                                                                    Function 003DB55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DB34E: GetWindowLongW.USER32(?,000000EB), ref: 003DB35F
                                                                                                    • DefDlgProcW.USER32(?,00000020,?,00000000), ref: 003DB5A5
                                                                                                    • GetClientRect.USER32(?,?), ref: 0043E69A
                                                                                                    • GetCursorPos.USER32(?), ref: 0043E6A4
                                                                                                    • ScreenToClient.USER32(?,?), ref: 0043E6AF
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Client$CursorLongProcRectScreenWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 4127811313-0
                                                                                                    • Opcode ID: 8413b92e7100a39dc1a9704fe86f68e8c42ed512fd20f13cf5dd21205bb13764
                                                                                                    • Instruction ID: 25f31cb933191d0035efffb65c559357153f33eacbe13001b1b77e981ccf5876
                                                                                                    • Opcode Fuzzy Hash: 8413b92e7100a39dc1a9704fe86f68e8c42ed512fd20f13cf5dd21205bb13764
                                                                                                    • Instruction Fuzzy Hash: BF113676901029FBCF11DF94EC469AEB7B9EB0A304F410466F941E7240D734AA92CBA9
                                                                                                    Function 0040732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00407352
                                                                                                    • MessageBoxW.USER32(?,?,?,?), ref: 00407385
                                                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0040739B
                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004073A2
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                    • String ID:
                                                                                                    • API String ID: 2880819207-0
                                                                                                    • Opcode ID: 879b85e78fad27108bb4580958f01e739e36de98f1924c1bec476abae41c5543
                                                                                                    • Instruction ID: 3dde18133b5cd437ed936ca9d5d2277ea09fe2af9966287db4952a2ab31f4102
                                                                                                    • Opcode Fuzzy Hash: 879b85e78fad27108bb4580958f01e739e36de98f1924c1bec476abae41c5543
                                                                                                    • Instruction Fuzzy Hash: 22110876E04204BFD7119F68DC05E9F7BADAB45311F1443BAFD21E3291D6749D0087A9
                                                                                                    Function 003DD17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 003DD1BA
                                                                                                    • GetStockObject.GDI32(00000011), ref: 003DD1CE
                                                                                                    • SendMessageW.USER32(00000000,00000030,00000000), ref: 003DD1D8
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CreateMessageObjectSendStockWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 3970641297-0
                                                                                                    • Opcode ID: 5e5a554882c14d1aacf5cf818e0ddb62035fa063f2e6d44e8978bcb05b08e867
                                                                                                    • Instruction ID: a611a35b09ce9d94291ebdd5d0c048e50af71a469680ce1187e5b888269ea698
                                                                                                    • Opcode Fuzzy Hash: 5e5a554882c14d1aacf5cf818e0ddb62035fa063f2e6d44e8978bcb05b08e867
                                                                                                    • Instruction Fuzzy Hash: DE11A9B3501509BFEF124FA0AC50EEABB6DFF09364F050226FA1552260C7319C60ABA0
                                                                                                    Function 003F4DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                    • String ID:
                                                                                                    • API String ID: 3016257755-0
                                                                                                    • Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                                                                    • Instruction ID: e37c9072b9ee96285f17cfe27b799115cdeed496105f61403ab7ad2dfdc72d74
                                                                                                    • Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                                                                    • Instruction Fuzzy Hash: 4F01483604014EBBCF135E88DC01CEE3F66BB28350B598455FB2899131D336CAB2AB81
                                                                                                    Function 003E7452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003E7A0D: __getptd_noexit.LIBCMT ref: 003E7A0E
                                                                                                    • __lock.LIBCMT ref: 003E748F
                                                                                                    • InterlockedDecrement.KERNEL32(?), ref: 003E74AC
                                                                                                    • _free.LIBCMT ref: 003E74BF
                                                                                                    • InterlockedIncrement.KERNEL32(010675C0), ref: 003E74D7
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
                                                                                                    • String ID:
                                                                                                    • API String ID: 2704283638-0
                                                                                                    • Opcode ID: 06b56ec9309598e02556ed527817dd1b74063f50c8a3b667c439a92d8f7b0fa6
                                                                                                    • Instruction ID: 36102a2fb0a7d3786e8eda4a2ed1640c3d3a1a9a164f28b353ca34a630d9a03b
                                                                                                    • Opcode Fuzzy Hash: 06b56ec9309598e02556ed527817dd1b74063f50c8a3b667c439a92d8f7b0fa6
                                                                                                    • Instruction Fuzzy Hash: 2D01D631D097719BD713AF67940579DBB60BF04710F164215F8186B6C0CB345941CFD6
                                                                                                    Function 0042EA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 003DAFE3
                                                                                                      • Part of subcall function 003DAF83: SelectObject.GDI32(?,00000000), ref: 003DAFF2
                                                                                                      • Part of subcall function 003DAF83: BeginPath.GDI32(?), ref: 003DB009
                                                                                                      • Part of subcall function 003DAF83: SelectObject.GDI32(?,00000000), ref: 003DB033
                                                                                                    • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0042EA8E
                                                                                                    • LineTo.GDI32(00000000,?,?), ref: 0042EA9B
                                                                                                    • EndPath.GDI32(00000000), ref: 0042EAAB
                                                                                                    • StrokePath.GDI32(00000000), ref: 0042EAB9
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                                                    • String ID:
                                                                                                    • API String ID: 1539411459-0
                                                                                                    • Opcode ID: cc7909f4e92101c3bc3fe7a5e8439c7527f5d7261fa6aceb2d12212c8782627c
                                                                                                    • Instruction ID: 385fe4b27f0d9787463225732df6633afaef795a4fef70ec0b03238ec560c4ee
                                                                                                    • Opcode Fuzzy Hash: cc7909f4e92101c3bc3fe7a5e8439c7527f5d7261fa6aceb2d12212c8782627c
                                                                                                    • Instruction Fuzzy Hash: 06F0E232401268BBDB129FA4AC0EFCE3F19AF06310F144216FE01611F183B85522CB9D
                                                                                                    Function 003FC82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 003FC84A
                                                                                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 003FC85D
                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 003FC864
                                                                                                    • AttachThreadInput.USER32(00000000), ref: 003FC86B
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 2710830443-0
                                                                                                    • Opcode ID: e4850202f72f26892f5954b33d67f3d673cabdcfcd94c76c2a082e2b3d99305d
                                                                                                    • Instruction ID: 248c5c51988ce3f9d0e8cb2e10fe50c2003158bd421d5f943a0ceecb7a81031b
                                                                                                    • Opcode Fuzzy Hash: e4850202f72f26892f5954b33d67f3d673cabdcfcd94c76c2a082e2b3d99305d
                                                                                                    • Instruction Fuzzy Hash: 35E06D7598122CBADB211BA2DC0DEEB7F1CEF167A1F018421FA0D84461C7B1C580CBE4
                                                                                                    Function 003FB0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetCurrentThread.KERNEL32 ref: 003FB0D6
                                                                                                    • OpenThreadToken.ADVAPI32(00000000,?,?,?,003FAC9D), ref: 003FB0DD
                                                                                                    • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,003FAC9D), ref: 003FB0EA
                                                                                                    • OpenProcessToken.ADVAPI32(00000000,?,?,?,003FAC9D), ref: 003FB0F1
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CurrentOpenProcessThreadToken
                                                                                                    • String ID:
                                                                                                    • API String ID: 3974789173-0
                                                                                                    • Opcode ID: c032d0ec4bc791cba58fb51f9d4502bb075b18c3fa37bcda7e1416b0be63c641
                                                                                                    • Instruction ID: 2ddca51f5b07bc4c61fefd55a852a152f6b04f487138b47367840a282210eb6e
                                                                                                    • Opcode Fuzzy Hash: c032d0ec4bc791cba58fb51f9d4502bb075b18c3fa37bcda7e1416b0be63c641
                                                                                                    • Instruction Fuzzy Hash: 66E08676F012129BD7201FB19C0DB577BA8EF56795F028838F741D6040DF348401C764
                                                                                                    Function 003DB47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetSysColor.USER32(00000008), ref: 003DB496
                                                                                                    • SetTextColor.GDI32(?,000000FF), ref: 003DB4A0
                                                                                                    • SetBkMode.GDI32(?,00000001), ref: 003DB4B5
                                                                                                    • GetStockObject.GDI32(00000005), ref: 003DB4BD
                                                                                                    • GetWindowDC.USER32(?,00000000), ref: 0043DE2B
                                                                                                    • GetPixel.GDI32(00000000,00000000,00000000), ref: 0043DE38
                                                                                                    • GetPixel.GDI32(00000000,?,00000000), ref: 0043DE51
                                                                                                    • GetPixel.GDI32(00000000,00000000,?), ref: 0043DE6A
                                                                                                    • GetPixel.GDI32(00000000,?,?), ref: 0043DE8A
                                                                                                    • ReleaseDC.USER32(?,00000000), ref: 0043DE95
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 1946975507-0
                                                                                                    • Opcode ID: c30d37f134e37e3b60f9607ebec8768f181df69aa38701fccd343991fb33cf03
                                                                                                    • Instruction ID: e8c0149404201d1ce22a04b473c405779ecc652310e42cdb3dd9139062c5a804
                                                                                                    • Opcode Fuzzy Hash: c30d37f134e37e3b60f9607ebec8768f181df69aa38701fccd343991fb33cf03
                                                                                                    • Instruction Fuzzy Hash: E6E06D35900280AADB225F64BC09BD97F11AB16336F00C226FAAA580E2C7714580CB15
                                                                                                    Function 0043B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 2889604237-0
                                                                                                    • Opcode ID: 05c391f541e39d6fb15d825e3022dbe7aec94894e463bf182aef4b77173c6dfe
                                                                                                    • Instruction ID: 1fa1c5abb36c59ccb916848acd36469e4b3eb358bea5a8faaf2664f76dc6a2fe
                                                                                                    • Opcode Fuzzy Hash: 05c391f541e39d6fb15d825e3022dbe7aec94894e463bf182aef4b77173c6dfe
                                                                                                    • Instruction Fuzzy Hash: 84E04FB9900204EFDB025F70D84C62E7BA8EF4C351F12C826FD5A8B310CB7498418B48
                                                                                                    Function 003FB2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 003FB2DF
                                                                                                    • UnloadUserProfile.USERENV(?,?), ref: 003FB2EB
                                                                                                    • CloseHandle.KERNEL32(?), ref: 003FB2F4
                                                                                                    • CloseHandle.KERNEL32(?), ref: 003FB2FC
                                                                                                      • Part of subcall function 003FAB24: GetProcessHeap.KERNEL32(00000000,?,003FA848), ref: 003FAB2B
                                                                                                      • Part of subcall function 003FAB24: HeapFree.KERNEL32(00000000), ref: 003FAB32
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                    • String ID:
                                                                                                    • API String ID: 146765662-0
                                                                                                    • Opcode ID: 6d0eef78e27242bd6aef27b0c06f52973315ee54c4336a0d10f2a07c6ff86777
                                                                                                    • Instruction ID: c23c2748dc559da090f4b813b6a0939cedb722e882db89bead5a524db7deb0a3
                                                                                                    • Opcode Fuzzy Hash: 6d0eef78e27242bd6aef27b0c06f52973315ee54c4336a0d10f2a07c6ff86777
                                                                                                    • Instruction Fuzzy Hash: 81E0B63A504405BBCB022FA5EC08859FBA6FF8A7213108231FA2581575CB32A871EB95
                                                                                                    Function 0043B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                    • String ID:
                                                                                                    • API String ID: 2889604237-0
                                                                                                    • Opcode ID: 4d8d749e8b7aebf730f9f0f88ade48e8c44693abdbc234839605a9c44acacbd5
                                                                                                    • Instruction ID: ff11510abe76935fc4e7b87c27826231d365fc045868a94d97b81f3d53841ce3
                                                                                                    • Opcode Fuzzy Hash: 4d8d749e8b7aebf730f9f0f88ade48e8c44693abdbc234839605a9c44acacbd5
                                                                                                    • Instruction Fuzzy Hash: 9AE04FB9900200EFDB015F70D84862D7BA8EB4D351F128426F95A8B310CB7599008B04
                                                                                                    Function 003FDCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • OleSetContainedObject.OLE32(?,00000001), ref: 003FDEAA
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ContainedObject
                                                                                                    • String ID: AutoIt3GUI$Container
                                                                                                    • API String ID: 3565006973-3941886329
                                                                                                    • Opcode ID: 2b9074a8fb8c6b291e3c04ec3c133d310d4d32f6aed73b0ef3f89e99c05673a1
                                                                                                    • Instruction ID: b9e37cb87aa8c9940879126a7a34b1ba1985b46e4e8c4dac340f1ec47740f1ad
                                                                                                    • Opcode Fuzzy Hash: 2b9074a8fb8c6b291e3c04ec3c133d310d4d32f6aed73b0ef3f89e99c05673a1
                                                                                                    • Instruction Fuzzy Hash: 32913670600705AFDB15DF64C888F6AB7BAAF49710F20856EF94ACF691DB70E841CB50
                                                                                                    Function 0040290D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _wcscpy
                                                                                                    • String ID: I/C$I/C
                                                                                                    • API String ID: 3048848545-142925007
                                                                                                    • Opcode ID: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
                                                                                                    • Instruction ID: f994d653cc93a89159358f396ed242a08f15e7841665bd7f5f7378ed4dda3518
                                                                                                    • Opcode Fuzzy Hash: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
                                                                                                    • Instruction Fuzzy Hash: D9412C71A00116AACF25EF94D545AFEB7B0EF48310F54506BE881BB2D1DBB85E82CB58
                                                                                                    Function 003DBCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • Sleep.KERNEL32(00000000), ref: 003DBCDA
                                                                                                    • GlobalMemoryStatusEx.KERNEL32 ref: 003DBCF3
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: GlobalMemorySleepStatus
                                                                                                    • String ID: @
                                                                                                    • API String ID: 2783356886-2766056989
                                                                                                    • Opcode ID: e950560db8181ace19d3e2950ab5974b16177f98769c5db11ed42be0e4431419
                                                                                                    • Instruction ID: 6380e3de006f5dc64ccd1bcb80baf9053015c4c6b65b9a95427b356260f8ad7a
                                                                                                    • Opcode Fuzzy Hash: e950560db8181ace19d3e2950ab5974b16177f98769c5db11ed42be0e4431419
                                                                                                    • Instruction Fuzzy Hash: 4A515A724187449BE321AF24EC85BAFBBECFF94354F41485EF1C8461A2DB7089A8C756
                                                                                                    Function 0040C56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003C44ED: __fread_nolock.LIBCMT ref: 003C450B
                                                                                                    • _wcscmp.LIBCMT ref: 0040C65D
                                                                                                    • _wcscmp.LIBCMT ref: 0040C670
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: _wcscmp$__fread_nolock
                                                                                                    • String ID: FILE
                                                                                                    • API String ID: 4029003684-3121273764
                                                                                                    • Opcode ID: c4b2546a78dcfaa6d7e2cea486558137a4cb7bcbc545519cf221f19c9fb23a32
                                                                                                    • Instruction ID: 72812e06c3d582a10cd4e808b33af3e18846566890d51b7a082d73037586e1d8
                                                                                                    • Opcode Fuzzy Hash: c4b2546a78dcfaa6d7e2cea486558137a4cb7bcbc545519cf221f19c9fb23a32
                                                                                                    • Instruction Fuzzy Hash: 9B41E572A0021ABADF21ABA58C81FEF77B9EF49704F00447AF605FB1C1D6759A048B55
                                                                                                    Function 0042A76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,00001132,00000000,?), ref: 0042A85A
                                                                                                    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0042A86F
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend
                                                                                                    • String ID: '
                                                                                                    • API String ID: 3850602802-1997036262
                                                                                                    • Opcode ID: f6464ff5536b25b9cc208fbf4e8f0e275e147221e28e03f51cac9cf53b091880
                                                                                                    • Instruction ID: 325712f29a2872508e5d5c7ed6bf16880a833d825ab1cb25fc837f3c5c8a103b
                                                                                                    • Opcode Fuzzy Hash: f6464ff5536b25b9cc208fbf4e8f0e275e147221e28e03f51cac9cf53b091880
                                                                                                    • Instruction Fuzzy Hash: EC41F774A012199FDB14DF68D880BDABBB9FB48304F50006AED05EB351D774A952CFA9
                                                                                                    Function 0042975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • DestroyWindow.USER32(?,?,?,?), ref: 0042980E
                                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0042984A
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$DestroyMove
                                                                                                    • String ID: static
                                                                                                    • API String ID: 2139405536-2160076837
                                                                                                    • Opcode ID: c8d0a5a7f14ba5d047d98226343c5e012623bd03dfa17f38485e05faae7180cc
                                                                                                    • Instruction ID: dc3f3d58c1df4dd83946ddbd49538329c9399a9815906be2fe69dedbd9f78123
                                                                                                    • Opcode Fuzzy Hash: c8d0a5a7f14ba5d047d98226343c5e012623bd03dfa17f38485e05faae7180cc
                                                                                                    • Instruction Fuzzy Hash: A931A171210214AEEB109F74DC80BFB73A9FF99764F44861AF8A9C7250CA34AC41C768
                                                                                                    Function 00405157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 004051C6
                                                                                                    • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00405201
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: InfoItemMenu_memset
                                                                                                    • String ID: 0
                                                                                                    • API String ID: 2223754486-4108050209
                                                                                                    • Opcode ID: ed8b93360f396e092999105c633dcccfe1de0edd709d018cce0bce98de630999
                                                                                                    • Instruction ID: 834a1fa42307f04368adaa5e210bc54f8dbf8e4cd1e432eb5fab123be1f00b05
                                                                                                    • Opcode Fuzzy Hash: ed8b93360f396e092999105c633dcccfe1de0edd709d018cce0bce98de630999
                                                                                                    • Instruction Fuzzy Hash: AF31BF31A00204EBEB25DF99D845BAFBBB8EF45350F14047EE981B62E0D7789944CF15
                                                                                                    Function 0041658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __snwprintf
                                                                                                    • String ID: , $$AUTOITCALLVARIABLE%d
                                                                                                    • API String ID: 2391506597-2584243854
                                                                                                    • Opcode ID: 90531b67c8b0fbde7fb5630b804440238159202919702a4cfe6a035a64812121
                                                                                                    • Instruction ID: 10d94647c56bde21b10c253977fcf2d354a90238e261520f445b7ea14b102112
                                                                                                    • Opcode Fuzzy Hash: 90531b67c8b0fbde7fb5630b804440238159202919702a4cfe6a035a64812121
                                                                                                    • Instruction Fuzzy Hash: 99217F31600218AECF11EF64C882FEE73B4AF45300F15445AF505EB142DB78EE85DBA9
                                                                                                    Function 004293CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0042945C
                                                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00429467
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend
                                                                                                    • String ID: Combobox
                                                                                                    • API String ID: 3850602802-2096851135
                                                                                                    • Opcode ID: b49bfa509e0dfb07feac2f0557da93c56d4b6e04f524271ce9d15d37158800ff
                                                                                                    • Instruction ID: 427d26e238422fed75462fdec25c320f76a4917087021aa80811b8446a18146c
                                                                                                    • Opcode Fuzzy Hash: b49bfa509e0dfb07feac2f0557da93c56d4b6e04f524271ce9d15d37158800ff
                                                                                                    • Instruction Fuzzy Hash: 26119371300118BFEF15DE54EC80EBB376EEB483A4F50412AF91997290D6759C528764
                                                                                                    Function 0042DA42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DB34E: GetWindowLongW.USER32(?,000000EB), ref: 003DB35F
                                                                                                    • GetActiveWindow.USER32 ref: 0042DA7B
                                                                                                    • EnumChildWindows.USER32(?,0042D75F,00000000), ref: 0042DAF5
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$ActiveChildEnumLongWindows
                                                                                                    • String ID: T1A
                                                                                                    • API String ID: 3814560230-1399990730
                                                                                                    • Opcode ID: de62a64a4b0ac9a07e7d68aec63a5e94b726ad2eb638683486cff638d0cf157d
                                                                                                    • Instruction ID: a66c589d6022a638f92a804441e1cb8e378ee228f2d95deaecb9e2965b9c74be
                                                                                                    • Opcode Fuzzy Hash: de62a64a4b0ac9a07e7d68aec63a5e94b726ad2eb638683486cff638d0cf157d
                                                                                                    • Instruction Fuzzy Hash: 97214F35604211DFC715DF28E850AAAB7E9EF59320F65062FF8A5973E0DB34A801CF68
                                                                                                    Function 004298FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                      • Part of subcall function 003DD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 003DD1BA
                                                                                                      • Part of subcall function 003DD17C: GetStockObject.GDI32(00000011), ref: 003DD1CE
                                                                                                      • Part of subcall function 003DD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 003DD1D8
                                                                                                    • GetWindowRect.USER32(00000000,?), ref: 00429968
                                                                                                    • GetSysColor.USER32(00000012), ref: 00429982
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                                                    • String ID: static
                                                                                                    • API String ID: 1983116058-2160076837
                                                                                                    • Opcode ID: 3d06b1bb6d499d61e9622d6fab747b9f0ae3b33e8159abd7e16303e7b10b902b
                                                                                                    • Instruction ID: 49a5618c1a0a1c621acee00b29c2dc799a6b03042b882f7c12d470e0c90c1029
                                                                                                    • Opcode Fuzzy Hash: 3d06b1bb6d499d61e9622d6fab747b9f0ae3b33e8159abd7e16303e7b10b902b
                                                                                                    • Instruction Fuzzy Hash: 21116AB2610219AFDB04DFB8DC45AEA7BA8FB08354F01462DF955E3250E738E851DB64
                                                                                                    Function 00429617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetWindowTextLengthW.USER32(00000000), ref: 00429699
                                                                                                    • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004296A8
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: LengthMessageSendTextWindow
                                                                                                    • String ID: edit
                                                                                                    • API String ID: 2978978980-2167791130
                                                                                                    • Opcode ID: e259bd0349c32760ab92b085896bc09884693ae38f2046553d52a027c6ff85cd
                                                                                                    • Instruction ID: 08d0682283e37e2b423c81e77ca67c1c6fe2ecb26544a5f789d68bbd8c5fd4f8
                                                                                                    • Opcode Fuzzy Hash: e259bd0349c32760ab92b085896bc09884693ae38f2046553d52a027c6ff85cd
                                                                                                    • Instruction Fuzzy Hash: 5211BF71600114ABEB104FA4EC40EEB37AAEF05378F900726F965932E0C739DC519768
                                                                                                    Function 00405262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • _memset.LIBCMT ref: 004052D5
                                                                                                    • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 004052F4
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: InfoItemMenu_memset
                                                                                                    • String ID: 0
                                                                                                    • API String ID: 2223754486-4108050209
                                                                                                    • Opcode ID: b96c8b95011cba42a68b92f978be95827f0839a25016b571315e5046f923ef10
                                                                                                    • Instruction ID: 931ca4845cd5b918feadd7eec071d98424cd209293460ed1e21f215e222cb874
                                                                                                    • Opcode Fuzzy Hash: b96c8b95011cba42a68b92f978be95827f0839a25016b571315e5046f923ef10
                                                                                                    • Instruction Fuzzy Hash: 7211D072901614ABEB20EB98D905B9F77B8EB05750F14007BED01B72E0D3B4AD05CF99
                                                                                                    Function 00414D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00414DF5
                                                                                                    • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00414E1E
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Internet$OpenOption
                                                                                                    • String ID: <local>
                                                                                                    • API String ID: 942729171-4266983199
                                                                                                    • Opcode ID: 59faf55b4cd7d44df7df662d4f8ca2cb043a4c0479edf6e5ae24f7b3fa26c739
                                                                                                    • Instruction ID: 1477e40fc9202cdaba54ba40026e42a41e6dc97fd2ee5c7d33e9083a06f85509
                                                                                                    • Opcode Fuzzy Hash: 59faf55b4cd7d44df7df662d4f8ca2cb043a4c0479edf6e5ae24f7b3fa26c739
                                                                                                    • Instruction Fuzzy Hash: E6119E70601221BADB258F619888EEBFBA8FB46755F10822BF50556640D3785981C6F9
                                                                                                    Function 003EA70C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 003F37A7
                                                                                                    • ___raise_securityfailure.LIBCMT ref: 003F388E
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                                    • String ID: (H
                                                                                                    • API String ID: 3761405300-79067557
                                                                                                    • Opcode ID: 99002300469a83c95d3b1db85360d007a9db2605f4ebcff66ea84f8e8d49ac0e
                                                                                                    • Instruction ID: 5a805e18de47088d8790ab5f73e4fe0f80a807efda08122638fcf85488b8be6f
                                                                                                    • Opcode Fuzzy Hash: 99002300469a83c95d3b1db85360d007a9db2605f4ebcff66ea84f8e8d49ac0e
                                                                                                    • Instruction Fuzzy Hash: 3121F3B5521304DAE790DF59E98562A3BF5BB48310F119C3EE9088B7A1E3F46988CF4D
                                                                                                    Function 0041A82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 0041A84E
                                                                                                    • htons.WSOCK32(00000000,?,00000000), ref: 0041A88B
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: htonsinet_addr
                                                                                                    • String ID: 255.255.255.255
                                                                                                    • API String ID: 3832099526-2422070025
                                                                                                    • Opcode ID: 6b3daa3f2e93146f0d38eda44d2572079e8108afa0e7e9800bf2e58002db53d8
                                                                                                    • Instruction ID: b8fdb4c8ab642391c94f2aef655cfab6cebd57ef246698f05ebb94d36c017e0c
                                                                                                    • Opcode Fuzzy Hash: 6b3daa3f2e93146f0d38eda44d2572079e8108afa0e7e9800bf2e58002db53d8
                                                                                                    • Instruction Fuzzy Hash: 1C012674200305ABCB11EFA4C886FE9B364EF45314F10842BF5169B3D1C775E851C75A
                                                                                                    Function 003FB781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 003FB7EF
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend
                                                                                                    • String ID: ComboBox$ListBox
                                                                                                    • API String ID: 3850602802-1403004172
                                                                                                    • Opcode ID: 98e1b7b2ddf4efdcbc297bee50ca4ddb3ce56ec53f134a020deefdc71dfc8d32
                                                                                                    • Instruction ID: 0d7248a02c06604d10fbe545c1f82baca101ca007b526894d235346f5cc0239d
                                                                                                    • Opcode Fuzzy Hash: 98e1b7b2ddf4efdcbc297bee50ca4ddb3ce56ec53f134a020deefdc71dfc8d32
                                                                                                    • Instruction Fuzzy Hash: D201F1B1610118ABCB06EBA4CC52EFEB36DAF46350B14061DF566AB2D2EBB45D088794
                                                                                                    Function 003FB67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,00000180,00000000,?), ref: 003FB6EB
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend
                                                                                                    • String ID: ComboBox$ListBox
                                                                                                    • API String ID: 3850602802-1403004172
                                                                                                    • Opcode ID: fdade1289ce6ed34fb9cab16add0a5fa8b2bff4678038ac0b3ab0edc28e71557
                                                                                                    • Instruction ID: 412bc4e882de6713c1b9b933f52663738c22f38e5905a3f1a24a53e76d5bd485
                                                                                                    • Opcode Fuzzy Hash: fdade1289ce6ed34fb9cab16add0a5fa8b2bff4678038ac0b3ab0edc28e71557
                                                                                                    • Instruction Fuzzy Hash: 2B0167B5641108ABCB06EBA4C952FFEB3AD9F06344F14001DF506F7292EF945E1897B5
                                                                                                    Function 003FB700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • SendMessageW.USER32(?,00000182,?,00000000), ref: 003FB76C
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: MessageSend
                                                                                                    • String ID: ComboBox$ListBox
                                                                                                    • API String ID: 3850602802-1403004172
                                                                                                    • Opcode ID: 00ad091cfcbcd1205e2e8bb70e72ff584bd2d6d41efd82e471464da8ebbbbf09
                                                                                                    • Instruction ID: bfc2e1183dc843f82ae4866566509d5f22bde0721f2fa5b265b4be18ec4c6280
                                                                                                    • Opcode Fuzzy Hash: 00ad091cfcbcd1205e2e8bb70e72ff584bd2d6d41efd82e471464da8ebbbbf09
                                                                                                    • Instruction Fuzzy Hash: CC01A2B5640108ABCB02F7A4CA02FFEB3AD9F06340F240029B505B7292DBA55E0987B5
                                                                                                    Function 003E4D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: __calloc_crt
                                                                                                    • String ID: "H
                                                                                                    • API String ID: 3494438863-998513438
                                                                                                    • Opcode ID: 0391658e42c92d7d2b7aa67a052e1869943f333eed6e8654fc8f6ae760052e13
                                                                                                    • Instruction ID: 56713a10f36ca657d185f135e5139a8c7b66763efaa0febe53342cfbea35cce8
                                                                                                    • Opcode Fuzzy Hash: 0391658e42c92d7d2b7aa67a052e1869943f333eed6e8654fc8f6ae760052e13
                                                                                                    • Instruction Fuzzy Hash: 0EF028302082A18AE3168F1ABD416AB67D4F708760B108B6FF600CE2C6E7B0C8414798
                                                                                                    Function 003C4024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • LoadImageW.USER32(003C0000,00000063,00000001,00000010,00000010,00000000), ref: 003C4048
                                                                                                    • EnumResourceNamesW.KERNEL32(00000000,0000000E,004067E9,00000063,00000000,75A50280,?,?,003C3EE1,?,?,000000FF), ref: 004341B3
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: EnumImageLoadNamesResource
                                                                                                    • String ID: ><
                                                                                                    • API String ID: 1578290342-2325476198
                                                                                                    • Opcode ID: b0eeef97d047c35aa4e0ad77b6c6c13ce6d46669e0f29cc1343003beecf9b59b
                                                                                                    • Instruction ID: 47a58fa1dda09302d2c8999e5021ee7f82488c4bb92f19018dfb75afd7bc783b
                                                                                                    • Opcode Fuzzy Hash: b0eeef97d047c35aa4e0ad77b6c6c13ce6d46669e0f29cc1343003beecf9b59b
                                                                                                    • Instruction Fuzzy Hash: 39F0963564032077D6205B15BC4AFD67A5DE74AFB5F10492FF714EB1E0D2F094819798
                                                                                                    Function 00407744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: ClassName_wcscmp
                                                                                                    • String ID: #32770
                                                                                                    • API String ID: 2292705959-463685578
                                                                                                    • Opcode ID: 367f3aa7ba534c2af32cefe8877b6dbf0d9aca668ed5890342730e30528109cf
                                                                                                    • Instruction ID: 1026a25d6ed446becab55e69ce582de9ac6230f9346b1740f18c9a2fcfc262cd
                                                                                                    • Opcode Fuzzy Hash: 367f3aa7ba534c2af32cefe8877b6dbf0d9aca668ed5890342730e30528109cf
                                                                                                    • Instruction Fuzzy Hash: 0EE09277A0432427D720ABA59C09ECBFBACAB51B60F11012AB905E3181D674A60187D8
                                                                                                    Function 003FA631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 003FA63F
                                                                                                      • Part of subcall function 003E13F1: _doexit.LIBCMT ref: 003E13FB
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: Message_doexit
                                                                                                    • String ID: AutoIt$Error allocating memory.
                                                                                                    • API String ID: 1993061046-4017498283
                                                                                                    • Opcode ID: 9840d8cae36ea1480a4ed66423f9f02651213707737ec71f3c082e4c8a6dcdb7
                                                                                                    • Instruction ID: 4e3d249c707bf70665ce0b1cbfb1e08a44e82a608256ca0a9ccb878152649a26
                                                                                                    • Opcode Fuzzy Hash: 9840d8cae36ea1480a4ed66423f9f02651213707737ec71f3c082e4c8a6dcdb7
                                                                                                    • Instruction Fuzzy Hash: 5FD0C23238032832D21626987C07FD976488B05B51F140026FB0CD96C349E6998002DD
                                                                                                    Function 0043AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • GetSystemDirectoryW.KERNEL32(?), ref: 0043ACC0
                                                                                                    • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0043AEBD
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: DirectoryFreeLibrarySystem
                                                                                                    • String ID: WIN_XPe
                                                                                                    • API String ID: 510247158-3257408948
                                                                                                    • Opcode ID: 6d8ecf3bca06527ae934e0e127c6d4283f8970e05bb59a011b81b622abcc87b9
                                                                                                    • Instruction ID: 01cc7945494ee000aaa03dabea7d04dcdfbfdab0f8552c7f7449fe94d86572fc
                                                                                                    • Opcode Fuzzy Hash: 6d8ecf3bca06527ae934e0e127c6d4283f8970e05bb59a011b81b622abcc87b9
                                                                                                    • Instruction Fuzzy Hash: 2BE06D70C00509DFCB11DBA5D9449ECB7B8AB4C300F10A097E442B2260CB785A85DF2A
                                                                                                    Function 004286CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004286E2
                                                                                                    • PostMessageW.USER32(00000000), ref: 004286E9
                                                                                                      • Part of subcall function 00407A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00407AD0
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: FindMessagePostSleepWindow
                                                                                                    • String ID: Shell_TrayWnd
                                                                                                    • API String ID: 529655941-2988720461
                                                                                                    • Opcode ID: 4a8f51692e3803a004069672886c6ddf0a564f9f9547d52846ceaeaa48e205e2
                                                                                                    • Instruction ID: aed55f856de2ca107b591a7fa7459c2349cb9b2826964dbd343545a531e29c23
                                                                                                    • Opcode Fuzzy Hash: 4a8f51692e3803a004069672886c6ddf0a564f9f9547d52846ceaeaa48e205e2
                                                                                                    • Instruction Fuzzy Hash: 74D0C935B853147BF26467709C0BFC66A589B05B11F11082AB649AA1D0C9B8A9408A5D
                                                                                                    Function 00428698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                                    Download Yara Rule
                                                                                                    APIs
                                                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004286A2
                                                                                                    • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 004286B5
                                                                                                      • Part of subcall function 00407A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00407AD0
                                                                                                    Strings
                                                                                                    Memory Dump Source
                                                                                                    • Source File: 00000004.00000002.1303500871.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true
                                                                                                    • Associated: 00000004.00000002.1303471573.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000044D000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303629446.000000000046E000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303681392.000000000047A000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                    • Associated: 00000004.00000002.1303699654.0000000000484000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                    Joe Sandbox IDA Plugin
                                                                                                    • Snapshot File: hcaresult_4_2_3c0000_brief nr.jbxd
                                                                                                    Similarity
                                                                                                    • API ID: FindMessagePostSleepWindow
                                                                                                    • String ID: Shell_TrayWnd
                                                                                                    • API String ID: 529655941-2988720461
                                                                                                    • Opcode ID: 9d99c74f96b1bdaccd084f4e5b7b90f12e182f59ab91120fb284634eb314485d
                                                                                                    • Instruction ID: 2fdd1cabea2a727cfbde82d41ad00a4244738b19824ed97ffeb00630512aa5d1
                                                                                                    • Opcode Fuzzy Hash: 9d99c74f96b1bdaccd084f4e5b7b90f12e182f59ab91120fb284634eb314485d
                                                                                                    • Instruction Fuzzy Hash: 5ED01235B84314B7F36477709C0BFC67A589B05B11F11082AB74DAA1D0C9F8E940CB5C